[dependabot]

Bumps @sentry/react from 10.75.0 to 11.10.0.

Release notes

Sourced from @​sentry/react's releases.

11.10.0

Important Changes

• feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

  Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

  To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

  // browser
  Sentry.init({ dsn, tunnel: true });
  // server
  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

  app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

  The request option of handleTunnelRequest is deprecated and will be removed in v12.

• feat: Make span origins spec compliant (#25602)

  Some span origins changed their names to follow the trace origin spec:

  • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
  • auto.vercelai.channel is now auto.ai.vercelai.
  • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
  • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
  • auto.aws_lambda is now auto.function.aws_serverless.
  • auto.mcp.notification is now auto.function.mcp_server.notification.
  • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
  • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

  bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

  Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

  ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

• feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

  sentryBunPlugin from @sentry/bun/plugin now accepts the same options as sentryEsbuildPlugin (org, project, authToken, release, sourcemaps, ...). When Bun.build writes source maps to outdir, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to run sentry sourcemap inject and sentry sourcemap upload after the build.

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

11.10.0

Important Changes

• feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

  Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

  To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

  // browser
  Sentry.init({ dsn, tunnel: true });
  // server
  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

  app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

  The request option of handleTunnelRequest is deprecated and will be removed in v12.

• feat: Make span origins spec compliant (#25602)

  Some span origins changed their names to follow the trace origin spec:

  • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
  • auto.vercelai.channel is now auto.ai.vercelai.
  • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
  • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
  • auto.aws_lambda is now auto.function.aws_serverless.
  • auto.mcp.notification is now auto.function.mcp_server.notification.
  • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
  • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

  bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

  Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

  ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

• feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

... (truncated)

Commits

• 9e33660 release: 11.10.0
• a51d938 Merge pull request #25832 from getsentry/prepare-release/11.10.0
• 612654c meta(changelog): Update changelog for 11.10.0
• 0455361 Merge pull request #25833 from getsentry/ab/merge-master-into-develop
• 0e2b465 chore: Merge master into develop
• 90a71e7 feat(server-utils): Instrument together-ai 1.x (#25823)
• c6ac34c test(cloudflare): Bump agents and MCP SDK in cloudflare-mcp-agent e2e app (#2...
• 6efffd8 test(remix): Cover prefetched navigations in the Remix 3 E2E app (#25829)
• e17a480 fix(remix): Drop Remix 3 release candidates from the peer range (#25808)
• cad66c7 test: Wire the managed tunnel by hand in Node, Cloudflare and Next.js (#25785)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

👋 This PR is a major version bump and requires manual review before merging.

Please check the upstream changelog for breaking changes, update any
affected call-sites, and verify that CI passes end-to-end before
approving.

See the Dependabot auto-merge policy in CONTRIBUTING.md for details.

[github-actions]

👋 This PR is a major version bump and requires manual review before merging.

Please check the upstream changelog for breaking changes, update any
affected call-sites, and verify that CI passes end-to-end before
approving.

See the Dependabot auto-merge policy in CONTRIBUTING.md for details.

[dependabot]

Superseded by #1285.