chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-sentry-nextjs-vulnerability
Open

chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-sentry-nextjs-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Aug 8, 2024•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence

Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

CVE-2023-46729 / GHSA-2rmr-xw8m-22q9

More information

Details

Impact

An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:

  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.

This issue only affects users who have Next.js SDK tunneling feature enabled.

Patches

The problem has been fixed in sentry/nextjs@7.77.0

Workarounds

Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.

References
Credits

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

getsentry/sentry-javascript (@​sentry/nextjs)

v7.77.0

Compare Source

Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB

v7.76.0

Compare Source

Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)

This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:

import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)

Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!

Bundle size 📦

PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB

v7.75.1

Compare Source

  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)

Bundle size 📦

PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB

v7.75.0

Compare Source

Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)

This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.

You can read more about @​sentry/opentelemetry in the Readme.

  • feat(replay): Allow to treeshake rrweb features (#​9274)

Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:

  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__

You can read more about tree shaking in our docs.

Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB

v7.74.1

Compare Source

  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)

Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!

Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB

v7.74.0

Compare Source

Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)

This Release introduces the first alpha version of our new SDK for Astro.
At this time, the SDK is considered experimental and things might break and change in future versions.

The core of the SDK is an Astro integration which you easily add to your Astro config:

// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});

Check out the README for usage instructions and what to expect from this alpha release.

Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)

Work in this release contributed by @​aldenquimby. Thank you for your contributions!

Bundle size 📦

PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovateBot requested a review from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot requested a review from sullivanpj as a code ownerAugust 8, 2024 02:47
@sonarqubecloud

sonarqubecloudBot commented Aug 8, 2024

Copy link
Copy Markdown

Quality Gate PassedQuality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from a35ecbf to b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot reviewed Jan 25, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT

@socket-security

socket-securityBot commented Jan 25, 2025•
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated

Confidence: 0.90

Location:Package overview

From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated

Confidence: 0.90

Location:Package overview

From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jiti@2.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated

Confidence: 0.90

Location:Package overview

From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@2.80.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated

Confidence: 0.90

Location:Package overview

From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from b371005 to a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot reviewed Jan 31, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from a8eb5c8 to 75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot reviewed Feb 12, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 75d0784 to fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot reviewed Mar 4, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from fb1792c to 62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot reviewed Mar 13, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 62e4c1a to 3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot reviewed Mar 14, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 3f857a2 to 8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot reviewed Mar 19, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 8d43809 to 5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot reviewed Apr 4, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 5388fed to 4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot reviewed Apr 10, 2025
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@sonarqubecloud

sonarqubecloudBot commented Apr 10, 2025

Copy link
Copy Markdown

Quality Gate PassedQuality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 4cc7ec3 to 6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot requested a review from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot reviewed Apr 15, 2026
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 6d8bcb9 to c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot reviewed Apr 30, 2026
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from c8eded0 to 2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot reviewed May 13, 2026
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 2af5745 to 6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot reviewed May 22, 2026
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 6220bfe to 9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot reviewed May 30, 2026
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 9828f1e to 555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot reviewed Jun 4, 2026
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@socket-security

socket-securityBot commented Jun 4, 2026•
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100

View full report

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 555f438 to 5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot reviewed Jun 13, 2026
View reviewed changes

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@renovate
renovateBotforce-pushed the renovate/npm-sentry-nextjs-vulnerability branch from 5598f78 to 304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Open
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Aug 8, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
CVE-2023-46729 / GHSA-2rmr-xw8m-22q9
More information
Details
Impact
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.
This issue only affects users who have Next.js SDK tunneling feature enabled.
Patches
The problem has been fixed in sentry/nextjs@7.77.0
Workarounds
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
References
Credits
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@​sentry/nextjs)
v7.77.0
Compare Source
Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB
v7.76.0
Compare Source
Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)
This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:
import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.1
Compare Source
  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.0
Compare Source
Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)
This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.
You can read more about @​sentry/opentelemetry in the Readme.
  • feat(replay): Allow to treeshake rrweb features (#​9274)
Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
You can read more about tree shaking in our docs.
Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.74.1
Compare Source
  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB
v7.74.0
Compare Source
Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)
This Release introduces the first alpha version of our new SDK for Astro.

At this time, the SDK is considered experimental and things might break and change in future versions.
The core of the SDK is an Astro integration which you easily add to your Astro config:
// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});
Check out the README for usage instructions and what to expect from this alpha release.
Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)
Work in this release contributed by @​aldenquimby. Thank you for your contributions!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerAugust 8, 2024 02:47
@sonarqubecloud
sonarqubecloudBot
commented
Aug 8, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a35ecbf to
b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot
reviewed
Jan 25, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@socket-security
socket-securityBot
commented
Jan 25, 2025•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/es-abstract@1.24.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jiti@2.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/rollup@2.80.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
b371005 to
a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot
reviewed
Jan 31, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a8eb5c8 to
75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Feb 12, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
75d0784 to
fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot
reviewed
Mar 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
fb1792c to
62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Mar 13, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
62e4c1a to
3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot
reviewed
Mar 14, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
3f857a2 to
8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot
reviewed
Mar 19, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
8d43809 to
5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot
reviewed
Apr 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5388fed to
4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot
reviewed
Apr 10, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@sonarqubecloud
sonarqubecloudBot
commented
Apr 10, 2025

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
4cc7ec3 to
6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot
reviewed
Apr 15, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6d8bcb9 to
c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot
reviewed
Apr 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
c8eded0 to
2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot
reviewed
May 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
2af5745 to
6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot
reviewed
May 22, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6220bfe to
9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot
reviewed
May 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
9828f1e to
555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot
reviewed
Jun 4, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@socket-security
socket-securityBot
commented
Jun 4, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
555f438 to
5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot
reviewed
Jun 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5598f78 to
304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Open
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Aug 8, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
CVE-2023-46729 / GHSA-2rmr-xw8m-22q9
More information
Details
Impact
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.
This issue only affects users who have Next.js SDK tunneling feature enabled.
Patches
The problem has been fixed in sentry/nextjs@7.77.0
Workarounds
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
References
Credits
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@​sentry/nextjs)
v7.77.0
Compare Source
Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB
v7.76.0
Compare Source
Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)
This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:
import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.1
Compare Source
  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.0
Compare Source
Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)
This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.
You can read more about @​sentry/opentelemetry in the Readme.
  • feat(replay): Allow to treeshake rrweb features (#​9274)
Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
You can read more about tree shaking in our docs.
Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.74.1
Compare Source
  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB
v7.74.0
Compare Source
Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)
This Release introduces the first alpha version of our new SDK for Astro.

At this time, the SDK is considered experimental and things might break and change in future versions.
The core of the SDK is an Astro integration which you easily add to your Astro config:
// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});
Check out the README for usage instructions and what to expect from this alpha release.
Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)
Work in this release contributed by @​aldenquimby. Thank you for your contributions!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerAugust 8, 2024 02:47
@sonarqubecloud
sonarqubecloudBot
commented
Aug 8, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a35ecbf to
b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot
reviewed
Jan 25, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@socket-security
socket-securityBot
commented
Jan 25, 2025•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/es-abstract@1.24.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jiti@2.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/rollup@2.80.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
b371005 to
a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot
reviewed
Jan 31, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a8eb5c8 to
75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Feb 12, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
75d0784 to
fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot
reviewed
Mar 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
fb1792c to
62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Mar 13, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
62e4c1a to
3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot
reviewed
Mar 14, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
3f857a2 to
8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot
reviewed
Mar 19, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
8d43809 to
5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot
reviewed
Apr 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5388fed to
4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot
reviewed
Apr 10, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@sonarqubecloud
sonarqubecloudBot
commented
Apr 10, 2025

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
4cc7ec3 to
6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot
reviewed
Apr 15, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6d8bcb9 to
c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot
reviewed
Apr 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
c8eded0 to
2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot
reviewed
May 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
2af5745 to
6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot
reviewed
May 22, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6220bfe to
9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot
reviewed
May 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
9828f1e to
555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot
reviewed
Jun 4, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@socket-security
socket-securityBot
commented
Jun 4, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
555f438 to
5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot
reviewed
Jun 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5598f78 to
304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Open
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Aug 8, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
CVE-2023-46729 / GHSA-2rmr-xw8m-22q9
More information
Details
Impact
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.
This issue only affects users who have Next.js SDK tunneling feature enabled.
Patches
The problem has been fixed in sentry/nextjs@7.77.0
Workarounds
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
References
Credits
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@​sentry/nextjs)
v7.77.0
Compare Source
Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB
v7.76.0
Compare Source
Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)
This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:
import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.1
Compare Source
  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.0
Compare Source
Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)
This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.
You can read more about @​sentry/opentelemetry in the Readme.
  • feat(replay): Allow to treeshake rrweb features (#​9274)
Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
You can read more about tree shaking in our docs.
Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.74.1
Compare Source
  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB
v7.74.0
Compare Source
Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)
This Release introduces the first alpha version of our new SDK for Astro.

At this time, the SDK is considered experimental and things might break and change in future versions.
The core of the SDK is an Astro integration which you easily add to your Astro config:
// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});
Check out the README for usage instructions and what to expect from this alpha release.
Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)
Work in this release contributed by @​aldenquimby. Thank you for your contributions!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerAugust 8, 2024 02:47
@sonarqubecloud
sonarqubecloudBot
commented
Aug 8, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a35ecbf to
b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot
reviewed
Jan 25, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@socket-security
socket-securityBot
commented
Jan 25, 2025•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/es-abstract@1.24.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jiti@2.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/rollup@2.80.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
b371005 to
a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot
reviewed
Jan 31, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a8eb5c8 to
75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Feb 12, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
75d0784 to
fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot
reviewed
Mar 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
fb1792c to
62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Mar 13, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
62e4c1a to
3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot
reviewed
Mar 14, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
3f857a2 to
8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot
reviewed
Mar 19, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
8d43809 to
5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot
reviewed
Apr 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5388fed to
4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot
reviewed
Apr 10, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@sonarqubecloud
sonarqubecloudBot
commented
Apr 10, 2025

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
4cc7ec3 to
6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot
reviewed
Apr 15, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6d8bcb9 to
c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot
reviewed
Apr 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
c8eded0 to
2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot
reviewed
May 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
2af5745 to
6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot
reviewed
May 22, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6220bfe to
9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot
reviewed
May 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
9828f1e to
555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot
reviewed
Jun 4, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@socket-security
socket-securityBot
commented
Jun 4, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
555f438 to
5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot
reviewed
Jun 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5598f78 to
304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Open
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Aug 8, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
CVE-2023-46729 / GHSA-2rmr-xw8m-22q9
More information
Details
Impact
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.
This issue only affects users who have Next.js SDK tunneling feature enabled.
Patches
The problem has been fixed in sentry/nextjs@7.77.0
Workarounds
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
References
Credits
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@​sentry/nextjs)
v7.77.0
Compare Source
Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB
v7.76.0
Compare Source
Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)
This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:
import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.1
Compare Source
  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.0
Compare Source
Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)
This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.
You can read more about @​sentry/opentelemetry in the Readme.
  • feat(replay): Allow to treeshake rrweb features (#​9274)
Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
You can read more about tree shaking in our docs.
Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.74.1
Compare Source
  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB
v7.74.0
Compare Source
Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)
This Release introduces the first alpha version of our new SDK for Astro.

At this time, the SDK is considered experimental and things might break and change in future versions.
The core of the SDK is an Astro integration which you easily add to your Astro config:
// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});
Check out the README for usage instructions and what to expect from this alpha release.
Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)
Work in this release contributed by @​aldenquimby. Thank you for your contributions!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerAugust 8, 2024 02:47
@sonarqubecloud
sonarqubecloudBot
commented
Aug 8, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a35ecbf to
b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot
reviewed
Jan 25, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@socket-security
socket-securityBot
commented
Jan 25, 2025•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/es-abstract@1.24.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jiti@2.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/rollup@2.80.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
b371005 to
a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot
reviewed
Jan 31, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a8eb5c8 to
75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Feb 12, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
75d0784 to
fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot
reviewed
Mar 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
fb1792c to
62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Mar 13, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
62e4c1a to
3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot
reviewed
Mar 14, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
3f857a2 to
8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot
reviewed
Mar 19, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
8d43809 to
5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot
reviewed
Apr 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5388fed to
4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot
reviewed
Apr 10, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@sonarqubecloud
sonarqubecloudBot
commented
Apr 10, 2025

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
4cc7ec3 to
6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot
reviewed
Apr 15, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6d8bcb9 to
c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot
reviewed
Apr 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
c8eded0 to
2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot
reviewed
May 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
2af5745 to
6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot
reviewed
May 22, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6220bfe to
9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot
reviewed
May 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
9828f1e to
555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot
reviewed
Jun 4, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@socket-security
socket-securityBot
commented
Jun 4, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
555f438 to
5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot
reviewed
Jun 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5598f78 to
304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Open
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Aug 8, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
CVE-2023-46729 / GHSA-2rmr-xw8m-22q9
More information
Details
Impact
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.
This issue only affects users who have Next.js SDK tunneling feature enabled.
Patches
The problem has been fixed in sentry/nextjs@7.77.0
Workarounds
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
References
Credits
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@​sentry/nextjs)
v7.77.0
Compare Source
Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB
v7.76.0
Compare Source
Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)
This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:
import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.1
Compare Source
  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.0
Compare Source
Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)
This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.
You can read more about @​sentry/opentelemetry in the Readme.
  • feat(replay): Allow to treeshake rrweb features (#​9274)
Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
You can read more about tree shaking in our docs.
Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.74.1
Compare Source
  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB
v7.74.0
Compare Source
Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)
This Release introduces the first alpha version of our new SDK for Astro.

At this time, the SDK is considered experimental and things might break and change in future versions.
The core of the SDK is an Astro integration which you easily add to your Astro config:
// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});
Check out the README for usage instructions and what to expect from this alpha release.
Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)
Work in this release contributed by @​aldenquimby. Thank you for your contributions!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerAugust 8, 2024 02:47
@sonarqubecloud
sonarqubecloudBot
commented
Aug 8, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a35ecbf to
b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot
reviewed
Jan 25, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@socket-security
socket-securityBot
commented
Jan 25, 2025•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/es-abstract@1.24.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jiti@2.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/rollup@2.80.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
b371005 to
a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot
reviewed
Jan 31, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a8eb5c8 to
75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Feb 12, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
75d0784 to
fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot
reviewed
Mar 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
fb1792c to
62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Mar 13, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
62e4c1a to
3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot
reviewed
Mar 14, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
3f857a2 to
8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot
reviewed
Mar 19, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
8d43809 to
5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot
reviewed
Apr 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5388fed to
4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot
reviewed
Apr 10, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@sonarqubecloud
sonarqubecloudBot
commented
Apr 10, 2025

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
4cc7ec3 to
6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot
reviewed
Apr 15, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6d8bcb9 to
c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot
reviewed
Apr 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
c8eded0 to
2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot
reviewed
May 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
2af5745 to
6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot
reviewed
May 22, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6220bfe to
9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot
reviewed
May 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
9828f1e to
555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot
reviewed
Jun 4, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@socket-security
socket-securityBot
commented
Jun 4, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
555f438 to
5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot
reviewed
Jun 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5598f78 to
304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Open
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Aug 8, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
CVE-2023-46729 / GHSA-2rmr-xw8m-22q9
More information
Details
Impact
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.
This issue only affects users who have Next.js SDK tunneling feature enabled.
Patches
The problem has been fixed in sentry/nextjs@7.77.0
Workarounds
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
References
Credits
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@​sentry/nextjs)
v7.77.0
Compare Source
Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB
v7.76.0
Compare Source
Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)
This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:
import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.1
Compare Source
  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.0
Compare Source
Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)
This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.
You can read more about @​sentry/opentelemetry in the Readme.
  • feat(replay): Allow to treeshake rrweb features (#​9274)
Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
You can read more about tree shaking in our docs.
Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.74.1
Compare Source
  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB
v7.74.0
Compare Source
Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)
This Release introduces the first alpha version of our new SDK for Astro.

At this time, the SDK is considered experimental and things might break and change in future versions.
The core of the SDK is an Astro integration which you easily add to your Astro config:
// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});
Check out the README for usage instructions and what to expect from this alpha release.
Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)
Work in this release contributed by @​aldenquimby. Thank you for your contributions!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerAugust 8, 2024 02:47
@sonarqubecloud
sonarqubecloudBot
commented
Aug 8, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a35ecbf to
b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot
reviewed
Jan 25, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@socket-security
socket-securityBot
commented
Jan 25, 2025•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/es-abstract@1.24.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jiti@2.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/rollup@2.80.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
b371005 to
a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot
reviewed
Jan 31, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a8eb5c8 to
75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Feb 12, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
75d0784 to
fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot
reviewed
Mar 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
fb1792c to
62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Mar 13, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
62e4c1a to
3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot
reviewed
Mar 14, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
3f857a2 to
8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot
reviewed
Mar 19, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
8d43809 to
5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot
reviewed
Apr 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5388fed to
4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot
reviewed
Apr 10, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@sonarqubecloud
sonarqubecloudBot
commented
Apr 10, 2025

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
4cc7ec3 to
6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot
reviewed
Apr 15, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6d8bcb9 to
c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot
reviewed
Apr 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
c8eded0 to
2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot
reviewed
May 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
2af5745 to
6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot
reviewed
May 22, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6220bfe to
9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot
reviewed
May 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
9828f1e to
555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot
reviewed
Jun 4, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@socket-security
socket-securityBot
commented
Jun 4, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
555f438 to
5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot
reviewed
Jun 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5598f78 to
304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security] - #35
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Open
chore(deps): update dependency @sentry/nextjs to v7.77.0 [security]#35
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-sentry-nextjs-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Aug 8, 2024•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
@sentry/nextjs (source)7.73.0 → 7.77.0ageconfidence
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
CVE-2023-46729 / GHSA-2rmr-xw8m-22q9
More information
Details
Impact
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This could open door for other attack vectors:
  • client-side vulnerabilities: XSS/CSRF in the context of the trusted domain;
  • interaction with internal network;
  • read cloud metadata endpoints (AWS, Azure, Google Cloud, etc.);
  • local/remote port scan.
This issue only affects users who have Next.js SDK tunneling feature enabled.
Patches
The problem has been fixed in sentry/nextjs@7.77.0
Workarounds
Disable tunneling by removing the tunnelRoute option from Sentry Next.js SDK config — next.config.js or next.config.mjs.
References
Credits
Severity
  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@​sentry/nextjs)
v7.77.0
Compare Source
Security Fixes
Other Changes
  • feat: Move LinkedErrors integration to @​sentry/core (#​9404)
  • feat(remix): Update sentry-cli version to ^2.21.2 (#​9401)
  • feat(replay): Allow to treeshake & configure compression worker URL (#​9409)
  • fix(angular-ivy): Adjust package entry points to support Angular 17 with SSR config (#​9412)
  • fix(feedback): Fixing feedback import (#​9403)
  • fix(utils): Avoid keeping a reference of last used event (#​9387)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.46 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)56.69 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.97 KB
@​sentry/browser - Webpack (gzipped)21.29 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.83 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.09 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.23 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.89 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)88.28 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)63.28 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.8 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.84 KB
@​sentry/react - Webpack (gzipped)21.34 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.18 KB
@​sentry/nextjs Client - Webpack (gzipped)47.86 KB
v7.76.0
Compare Source
Important Changes
  • feat(core): Add cron monitor wrapper helper (#​9395)
This release adds Sentry.withMonitor(), a wrapping function that wraps a callback with a cron monitor that will automatically report completions and failures:
import*asSentryfrom'@​sentry/node';// withMonitor() will send checkin when callback is started/finished// works with async and sync callbacks.constresult=Sentry.withMonitor('dailyEmail',()=>{// withMonitor return value is same return value herereturnsendEmail();},// Optional upsert options{schedule: {type: 'crontab',value: '0 * * * *',},// 🇨🇦🫡timezone: 'Canada/Eastern',},);
Other Changes
  • chore(angular-ivy): Allow Angular 17 in peer dependencies (#​9386)
  • feat(nextjs): Instrument SSR page components (#​9346)
  • feat(nextjs): Trace errors in page component SSR (#​9388)
  • fix(nextjs): Instrument route handlers with jsx and tsx file extensions (#​9362)
  • fix(nextjs): Trace with performance disabled (#​9389)
  • fix(replay): Ensure replay_id is not added to DSC if session expired (#​9359)
  • fix(replay): Remove unused parts of pako from build (#​9369)
  • fix(serverless): Don't mark all errors as unhandled (#​9368)
  • fix(tracing-internal): Fix case when middleware contain array of routes with special chars as @​ (#​9375)
  • meta(nextjs): Bump peer deps for Next.js 14 (#​9390)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)77.44 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)66.48 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)67.66 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)216.39 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)77.83 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)94.16 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.1
Compare Source
  • feat(browser): Allow collecting of pageload profiles (#​9317)
  • fix(browser): Correct timestamp on pageload profiles (#​9350)
  • fix(nextjs): Use webpack plugin release value to inject release (#​9348)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.75.0
Compare Source
Important Changes
  • feat(opentelemetry): Add new @sentry/opentelemetry package (#​9238)
This release publishes a new package, @sentry/opentelemetry. This is a runtime agnostic replacement for @sentry/opentelemetry-node and exports a couple of useful utilities which can be used to use Sentry together with OpenTelemetry.
You can read more about @​sentry/opentelemetry in the Readme.
  • feat(replay): Allow to treeshake rrweb features (#​9274)
Starting with this release, you can configure the following build-time flags in order to reduce the SDK bundle size:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_IFRAME__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
You can read more about tree shaking in our docs.
Other Changes
  • build(deno): Prepare Deno SDK for release on npm (#​9281)
  • feat: Remove tslib (#​9299)
  • feat(node): Add abnormal session support for ANR (#​9268)
  • feat(node): Remove lru_map dependency (#​9300)
  • feat(node): Vendor cookie module (#​9308)
  • feat(replay): Share performance instrumentation with tracing (#​9296)
  • feat(types): Add missing Profiling types (macho debug image, profile measurements, stack frame properties) (#​9277)
  • feat(types): Add statsd envelope types (#​9304)
  • fix(astro): Add integration default export to types entry point (#​9337)
  • fix(astro): Convert SDK init file import paths to POSIX paths (#​9336)
  • fix(astro): Make Replay and BrowserTracing integrations tree-shakeable (#​9287)
  • fix(integrations): Fix transaction integration (#​9334)
  • fix(nextjs): Restore autoInstrumentMiddleware functionality (#​9323)
  • fix(nextjs): Guard for case where getInitialProps may return undefined (#​9342)
  • fix(node-experimental): Make node-fetch support optional (#​9321)
  • fix(node): Check buffer length when attempting to parse ANR frame (#​9314)
  • fix(replay): Fix xhr start timestamps (#​9341)
  • fix(tracing-internal): Remove query params from urls with a trailing slash (#​9328)
  • fix(types): Remove typo with CheckInEnvelope (#​9303)
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)82.66 KB
@​sentry/browser (incl. Tracing, Replay) - Webpack with treeshaking flags (gzipped)71.77 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)30.94 KB
@​sentry/browser - Webpack (gzipped)21.26 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)73.03 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.93 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.09 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)233.81 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)87.77 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.76 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.71 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)83.05 KB
@​sentry/react - Webpack (gzipped)21.29 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)99.43 KB
@​sentry/nextjs Client - Webpack (gzipped)47.83 KB
v7.74.1
Compare Source
  • chore(astro): Add astro-integration keyword (#​9265)
  • fix(core): Narrow filters for health check transactions (#​9257)
  • fix(nextjs): Fix HMR by inserting new entrypoints at the end (#​9267)
  • fix(nextjs): Fix resolution of request async storage module (#​9259)
  • fix(node-experimental): Guard against missing fetch (#​9275)
  • fix(remix): Update defer injection logic. (#​9242)
  • fix(tracing-internal): Parameterize express middleware parameters (#​8668)
  • fix(utils): Move Node specific ANR impl. out of utils (#​9258)
Work in this release contributed by @​LubomirIgonda1. Thank you for your contribution!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)83.98 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.57 KB
@​sentry/browser - Webpack (gzipped)21.75 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)80.47 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)29.51 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.69 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)245.55 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)85.53 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)61.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)32.64 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.05 KB
@​sentry/react - Webpack (gzipped)21.79 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.18 KB
@​sentry/nextjs Client - Webpack (gzipped)49.65 KB
v7.74.0
Compare Source
Important Changes
  • feat(astro): Add sentryAstro integration (#​9218)
This Release introduces the first alpha version of our new SDK for Astro.

At this time, the SDK is considered experimental and things might break and change in future versions.
The core of the SDK is an Astro integration which you easily add to your Astro config:
// astro.config.jsimport{defineConfig}from"astro/config";importsentryfrom"@​sentry/astro";exportdefaultdefineConfig({integrations: [sentry({dsn: "__DSN__",sourceMapsUploadOptions: {project: "astro",authToken: process.env.SENTRY_AUTH_TOKEN,},}),],});
Check out the README for usage instructions and what to expect from this alpha release.
Other Changes
  • feat(core): Add addIntegration utility (#​9186)
  • feat(core): Add continueTrace method (#​9164)
  • feat(node-experimental): Add NodeFetch integration (#​9226)
  • feat(node-experimental): Use native OTEL Spans (#​9161, #​9214)
  • feat(node-experimental): Sample in OTEL Sampler (#​9203)
  • feat(serverlesss): Allow disabling transaction traces (#​9154)
  • feat(tracing): Allow direct pg module to enable esbuild support (#​9227)
  • feat(utils): Move common node ANR code to utils (#​9191)
  • feat(vue): Expose VueIntegration to initialize vue app later (#​9180)
  • fix: Don't set referrerPolicy on serverside fetch transports (#​9200)
  • fix: Ensure we never mutate options passed to init (#​9162)
  • fix(ember): Avoid pulling in utils at build time (#​9221)
  • fix(ember): Drop undefined config values (#​9175)
  • fix(node): Ensure mysql integration works without callback (#​9222)
  • fix(node): Only require inspector when needed (#​9149)
  • fix(node): Remove ANR debug option and instead add logger.isEnabled() (#​9230)
  • fix(node): Strip .mjs and .cjs extensions from module name (#​9231)
  • fix(replay): bump rrweb to 2.0.1 (#​9240)
  • fix(replay): Fix potential broken CSS in styled-components (#​9234)
  • fix(sveltekit): Flush in server wrappers before exiting (#​9153)
  • fix(types): Update signature of processEvent integration hook (#​9151)
  • fix(utils): Dereference DOM events after they have servered their purpose (#​9224)
  • ref(integrations): Refactor pluggable integrations to use processEvent (#​9021)
  • ref(serverless): Properly deprecate rethrowAfterCapture option (#​9159)
  • ref(utils): Deprecate walk method (#​9157)
Work in this release contributed by @​aldenquimby. Thank you for your contributions!
Bundle size 📦
PathSize
@​sentry/browser (incl. Tracing, Replay) - Webpack (gzipped)84.27 KB
@​sentry/browser (incl. Tracing) - Webpack (gzipped)31.43 KB
@​sentry/browser - Webpack (gzipped)22.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (gzipped)78.79 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (gzipped)28.6 KB
@​sentry/browser - ES6 CDN Bundle (gzipped)21.02 KB
@​sentry/browser (incl. Tracing, Replay) - ES6 CDN Bundle (minified & uncompressed)254.51 KB
@​sentry/browser (incl. Tracing) - ES6 CDN Bundle (minified & uncompressed)86.76 KB
@​sentry/browser - ES6 CDN Bundle (minified & uncompressed)62.45 KB
@​sentry/browser (incl. Tracing) - ES5 CDN Bundle (gzipped)31.48 KB
@​sentry/react (incl. Tracing, Replay) - Webpack (gzipped)84.3 KB
@​sentry/react - Webpack (gzipped)22.06 KB
@​sentry/nextjs Client (incl. Tracing, Replay) - Webpack (gzipped)102.21 KB
@​sentry/nextjs Client - Webpack (gzipped)50.96 KB
Configuration
📅 Schedule: (UTC)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from sullivanpjAugust 8, 2024 02:47
@renovate
renovateBot
requested a review
from sullivanpj
as a code ownerAugust 8, 2024 02:47
@sonarqubecloud
sonarqubecloudBot
commented
Aug 8, 2024

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a35ecbf to
b371005CompareJanuary 25, 2025 11:53
github-actions[bot]
github-actionsBot
reviewed
Jan 25, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@socket-security
socket-securityBot
commented
Jan 25, 2025•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm es-abstract is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/eslint-plugin-import@2.27.5 → npm/eslint-plugin-jsx-a11y@6.7.1 → npm/eslint-plugin-react@7.33.2 → npm/@asyncapi/generator@1.13.1 → npm/@asyncapi/parser@2.1.0 → npm/eslint-config-next@13.5.4 → npm/release-it@16.2.1 → npm/es-abstract@1.24.2
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/es-abstract@1.24.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm jiti is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/cz-conventional-changelog@3.3.0 → npm/jiti@2.6.1
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jiti@2.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm rollup is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@asyncapi/generator-react-sdk@0.2.25 → npm/rollup-plugin-url@3.0.1 → npm/@svgr/rollup@8.1.0 → npm/vite-plugin-dts@2.3.0 → npm/@rollup/plugin-url@7.0.0 → npm/rollup@2.80.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/rollup@2.80.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

WarnHigh
Obfuscated code: npm yargs is 90.0% likely obfuscated
Confidence: 0.90
Location:Package overview
From:pnpm-lock.yaml → npm/@nx-plus/docusaurus@15.0.0-rc.0 → npm/@nx/devkit@16.7.0 → npm/yargs@17.7.3
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/yargs@17.7.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
b371005 to
a8eb5c8CompareJanuary 31, 2025 23:08
github-actions[bot]
github-actionsBot
reviewed
Jan 31, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
a8eb5c8 to
75d0784CompareFebruary 12, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Feb 12, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
75d0784 to
fb1792cCompareMarch 4, 2025 00:10
github-actions[bot]
github-actionsBot
reviewed
Mar 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
fb1792c to
62e4c1aCompareMarch 13, 2025 00:06
github-actions[bot]
github-actionsBot
reviewed
Mar 13, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
62e4c1a to
3f857a2CompareMarch 14, 2025 00:22
github-actions[bot]
github-actionsBot
reviewed
Mar 14, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review by ChatGPT
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
3f857a2 to
8d43809CompareMarch 19, 2025 04:10
github-actions[bot]
github-actionsBot
reviewed
Mar 19, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
8d43809 to
5388fedCompareApril 4, 2025 03:40
github-actions[bot]
github-actionsBot
reviewed
Apr 4, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5388fed to
4cc7ec3CompareApril 10, 2025 00:15
github-actions[bot]
github-actionsBot
reviewed
Apr 10, 2025
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@sonarqubecloud
sonarqubecloudBot
commented
Apr 10, 2025

Copy link


Copy Markdown

Quality Gate PassedQuality Gate passed
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
4cc7ec3 to
6d8bcb9CompareApril 15, 2026 16:02
@renovate
renovateBot
requested a review
from a teamApril 15, 2026 16:02
github-actions[bot]
github-actionsBot
reviewed
Apr 15, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6d8bcb9 to
c8eded0CompareApril 30, 2026 02:15
github-actions[bot]
github-actionsBot
reviewed
Apr 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
c8eded0 to
2af5745CompareMay 13, 2026 07:45
github-actions[bot]
github-actionsBot
reviewed
May 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
2af5745 to
6220bfeCompareMay 22, 2026 08:12
github-actions[bot]
github-actionsBot
reviewed
May 22, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
6220bfe to
9828f1eCompareMay 30, 2026 11:54
github-actions[bot]
github-actionsBot
reviewed
May 30, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
9828f1e to
555f438CompareJune 4, 2026 20:12
github-actions[bot]
github-actionsBot
reviewed
Jun 4, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@socket-security
socket-securityBot
commented
Jun 4, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​sentry/​nextjs@​7.77.0961009596100
View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
555f438 to
5598f78CompareJune 13, 2026 03:47
github-actions[bot]
github-actionsBot
reviewed
Jun 13, 2026
View reviewed changes
@github-actionsgithub-actionsBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍
@renovate
renovateBotforce-pushed
the
renovate/npm-sentry-nextjs-vulnerability
branch
from
5598f78 to
304b823CompareJuly 16, 2026 07:51
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@github-actionsgithub-actions[bot]github-actions[bot] left review comments
@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants