… sus (#14695)

[Gitflow] Merge master into develop

Noticed that biome fix was failing on some stuff in the `.nuxt` folder
in E2E tests, so figured to add this as well (and while at it, also
ensure it is cleaned).

The v9 branch should not push to the v8 layer.

nitrojs/nitro#2703 fixed

---------

Co-authored-by: Sigrid Huemer <32902192+s1gr1d@users.noreply.github.com>

…w versions (#14707)

temporarily disables publishing a lambda layer while `develop`
is the branch where we cut v9 pre releases from. We shouldn't publish
prerelease layer versions since we can't mark these layers as
pre-release. They'd appear simply as stable new layer versions (with
incremented ARN number)

In order for us to have size-limit comparison etc, we need to ensure CI
runs on v8 & v9 branches too.

…king by default (#14602)

Resolves #12851

Fixes #14302

Resolves #14277

With this PR, the default value for the `spans` option in the
`httpIntegration` is changed to `false`, if `skipOpenTelemetrySetup:
true` is configured. This is what you'd expect as a user, you do not
want Sentry to register any OTEL instrumentation and emit any spans in
this scenario.

Closes #14675

…4711)

We should normalise all paths in ANR events if an appRoot path is
supplied. This is important for the Electron SDK where we normalise
around the app path to keep usernames out of reported events.

Adds a `maxAnrEvents` option to the ANR integration which allows you to
capture more than one event.

This change adds release name detection for Railway

Based on #12529

Related:
getsentry/sentry-javascript-bundler-plugins#639

…sts/test-applications/nextjs-t3 (#14712)

I was playing around with finally enabling the
[no-unnecessary-condition](https://typescript-eslint.io/rules/no-unnecessary-condition/)
eslint rule, and figured to start fixing some of the stuff it found.
These should mostly be straightforward things, or in some cases I
adjusted tests to ensure we "correctly" check for stuff.

We had some elaborate check in there for `window.history` which is based
on very old (~2016) issues, which should not be an issue anymore in
versions we support today. So we can streamline this quite a bit!

Additionally, I also rewrote code that used `window.onpushstate` to
instead of `window.addEventListener('pushstate')`, plus also added code
to ensure we do not emit history changes multiple times, which may be
possible (?).

Previously `spanToJSON` would return `Partial<SpanJSON>`. This meant
that you always had to guard all the stuff you picked from it - even
though in reality, we know that certain stuff will always be there.

To alleviate this, this PR changes this so that `spanToJSON` actually
returns `SpanJSON`. This means that in the fallback case, we return
`data: {}`, as well as a random (current) timestamp. Since we know that
in reality we will only have the two scenarios that we properly handle,
this is fine IMHO and makes usage of this everywhere else a little bit
less painful.

In a follow up, we can get rid of a bunch of `const data =
spanToJSON(span).data || {}` type code.

While at it, I also updated the type of `data` to `SpanAttributes`,
which is correct (it was `Record<string, any>` before). Since we only
allow span attributes to be set on this anyhow now, we can type this
better. This also uncovered a few places with slightly "incorrect" type
checks, I updated those too.

This change is on the v9 branch - I think it should not really be
breaking to a user in any way, as we simply return more data from
`spanToJSON`, and type what `data` is on there more tightly, so no
existing code relying on this should break. But to be safe, I figured we
may as well do that on v9 only.

#14726)

I do not really think this is breaking or has any impact on any user
code, but to be on the safe side, we can remove this in v9.

The one actual breaking thing is to also move the `encodePolyfill` /
`decodePolyfill` code to the versioned carrier - this was before still
on the global, making this a bit harder than necessary. In v9, this will
have to be set on the versioned carrier the same as other things - cc
@krystofwoldrich

Extracted out from
#14721

Today, we inline all the types into `deno/build/index.d.ts`. This used
to work "OK" previously, where all the types came from `@sentry/types`
and where thus all "simple types".

If we want to replace some of this with actual classes, e.g. `Scope` or
`Client` classes, this starts to fail, because now we have separate
definitions that do not match.

So to fix this, we now stop inlining all the types, but instead
re-export them from `@sentry/core`. While at this, I also updated the
test setup to ignore utils/types and just use core for everything.

With this change, `deno/build/index.d.ts` looks something like this:

```ts
import * as _sentry_core from '@sentry/core';
import { BaseTransportOptions, Options, TracePropagationTargets, ClientOptions, ServerRuntimeClient, Integration, Client } from '@sentry/core';
export { ... } from '@sentry/core';

// additional types from deno go here...
```

I do not _think_ this should be breaking, but 🤷 hard to say for sure
with these things.

Add `Sentry.updateSpanName()` to reliably update span
names in OpenTelemetry environments; prevents overwrites from both
OpenTelemetry HTTP instrumentation and Sentry's span inference logic;
preserves custom names by marking them with 'custom' source and storing
in temp field which takes precedence over the actual name and gets
deleted at the end

Because this config was added to the `includes`, the types were moved to
a subdirectory.
fixes #14732

The previous code was using fastify `request.routeOptions.method` which
is all methods the current route supports - not the current request
method.
Ex. `@All()` nestjs decorator `request.routeOptions.method = ['GET',
'POST', 'HEAD', ...]`

- Added a test for `@All()`
- Updated instances of fastify request to use `request.method` which
matches express

---------

Co-authored-by: Charly Gomez <charly.gomez@sentry.io>

This PR adds the external contributor to the CHANGELOG.md file, so that
they are credited for their contribution. See #15066

---------

Co-authored-by: chargome <20254395+chargome@users.noreply.github.com>
Co-authored-by: Francesco Gringl-Novy <francesco.novy@sentry.io>

…#15109)

Ref:
#5347 (comment)

Updates the `childProcessIntegration` to capture `worker_threads` errors
(including their stack traces) rather than capturing a breadcrumb.

This features is enabled by default and can be disabled by setting the
`captureWorkerErrors` option to `false`:

```ts
Sentry.init({
  dsn: 'https://public@dsn.ingest.sentry.io/1337',
  integrations: [Sentry.childProcessIntegration({ captureWorkerErrors: false })],
});
```

When `captureWorkerErrors: false`, a breadcrumb will be captured
instead.

This PR also adds more integration tests for the
`childProcessIntegration`.

Ref getsentry/team-replay#514. Adds an
integration for tracking Unleash flag evaluations, by patching the
[isEnabled](https://docs.getunleash.io/reference/sdks/javascript-browser#step-4-check-feature-toggle-states)
method prototype.
Ref https://develop.sentry.dev/sdk/expected-features/#feature-flags

PR pointing to v8:
#14948

…5062)

- Updates some cropping variable names to make it more clear that it's
only meant for cropping
- The pen tool button is improved in
#15102, which needs
to be merged first
- The drawing tool button needs to be "on" to annotate, but cropping can
happen at any time
- Once the button is "on", drawing happens on mouse down and mouse move,
and on mouse up, the drawing gets "squashed" onto the image. The
"squashing" can be moved to happen at a different time in a future PR if
we want to incorporate undo, selection, or erasing
- The experimental flag must be on to use annotations: `_experiments:
{annotations: true}`


https://github.com/user-attachments/assets/2fac5e56-5caf-454b-b8b3-afabbd2c31b9

Closes #15064

---------

Co-authored-by: Ryan Albrecht <ryan.albrecht@sentry.io>

…equestDataIntegration` (#15125)

…ns (#15108)

Extracted this out of
#14955

Instead of registering a general hook & filtering there, we can just use
the `beforeSpanEnd` hook that we already have/use to do this instead.

Removes the `fetchProxyScriptNonce` and in turn simplifies our
`transformPageChunk` callback a bit.

…5122)

…as escape hatch for all Prisma versions (#15127)