build(deps): bump @sentry/browser from 5.6.3 to 9.17.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: @sentry/browser.

Updates @sentry/browser from 5.6.3 to 9.17.0

Release notes

Sourced from @​sentry/browser's releases.

9.17.0

• feat(node): Migrate to @fastify/otel (#15542)

Bundle size 📦

Path	Size
@​sentry/browser	23.35 KB
@​sentry/browser - with treeshaking flags	23.19 KB
@​sentry/browser (incl. Tracing)	37.25 KB
@​sentry/browser (incl. Tracing, Replay)	74.47 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	68.34 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	79.12 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	90.93 KB
@​sentry/browser (incl. Feedback)	39.75 KB
@​sentry/browser (incl. sendFeedback)	27.98 KB
@​sentry/browser (incl. FeedbackAsync)	32.74 KB
@​sentry/react	25.16 KB
@​sentry/react (incl. Tracing)	39.24 KB
@​sentry/vue	27.63 KB
@​sentry/vue (incl. Tracing)	39.01 KB
@​sentry/svelte	23.38 KB
CDN Bundle	24.55 KB
CDN Bundle (incl. Tracing)	37.29 KB
CDN Bundle (incl. Tracing, Replay)	72.33 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	77.64 KB
CDN Bundle - uncompressed	71.62 KB
CDN Bundle (incl. Tracing) - uncompressed	110.34 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	221.63 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	234.15 KB
@​sentry/nextjs (client)	40.84 KB
@​sentry/sveltekit (client)	37.73 KB
@​sentry/node	151.37 KB
@​sentry/node - without tracing	95.77 KB
@​sentry/aws-serverless	120.16 KB

9.16.1

• fix(core): Make sure logs get flushed in server-runtime-client (#16222)
• ref(node): Remove vercel flushing code that does nothing (#16217)

Bundle size 📦

Path	Size
@​sentry/browser	23.35 KB
@​sentry/browser - with treeshaking flags	23.19 KB
@​sentry/browser (incl. Tracing)	37.25 KB
@​sentry/browser (incl. Tracing, Replay)	74.47 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	68.34 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	79.12 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

9.17.0

• feat(node): Migrate to @fastify/otel (#15542)

9.16.1

• fix(core): Make sure logs get flushed in server-runtime-client (#16222)
• ref(node): Remove vercel flushing code that does nothing (#16217)

9.16.0

Important changes

• feat: Create a Vite plugin that injects sentryConfig into the global config (#16197)

Add a new plugin makeConfigInjectorPlugin within our existing vite plugin that updates the global vite config with sentry options

• feat(browser): Add option to sample linked traces consistently (#16037)

This PR implements consistent sampling across traces as outlined in (#15754)

• feat(cloudflare): Add support for durable objects (#16180)

This PR introduces a new instrumentDurableObjectWithSentry method to the SDK, which instruments durable objects. We capture both traces and errors automatically.

• feat(node): Add Prisma integration by default (#16073)

Prisma integration is enabled by default, it should work for both ESM and CJS.

• feat(react-router): Add client-side router instrumentation (#16185)

Adds client-side instrumentation for react router's HydratedRouter. To enable it, simply replace browserTracingIntegration() with reactRouterTracingIntegration() in your client-side init call.

• fix(node): Avoid double-wrapping http module (#16177)

When running your application in ESM mode, there have been scenarios that resulted in the http/https emitting duplicate spans for incoming requests. This was apparently caused by us double-wrapping the modules for incoming request isolation.

In order to solve this problem, the modules are no longer monkey patched by us for request isolation. Instead, we register diagnosticschannel hooks to handle request isolation now. While this is generally not expected to break anything, there is one tiny change that _may affect you if you have been relying on very specific functionality:

The ignoreOutgoingRequests option of httpIntegration receives the RequestOptions as second argument. This type is not changed, however due to how the wrapping now works, we no longer pass through the full RequestOptions, but re-construct this partially based on the generated request. For the vast majority of cases, this should be fine, but for the sake of completeness, these are the only fields that may be available there going forward - other fields that may have existed before may no longer be set:

ignoreOutgoingRequests(url: string, {
  method: string;
  protocol: string;
  host: string;
  hostname: string; // same as host
  path: string;
  headers: OutgoingHttpHeaders;
</tr></table> 

... (truncated)

Commits

• cbf3d99 release: 9.17.0
• ef1f86b Merge pull request #16234 from getsentry/prepare-release/9.17.0
• 16af311 meta(changelog): Update changelog for 9.17.0
• 86794dd feat(node): Migrate to @fastify/otel (#15542)
• 57893e2 Merge pull request #16224 from getsentry/master
• 47f8bc6 Merge branch 'release/9.16.1'
• 1603866 release: 9.16.1
• 30487a1 Merge pull request #16223 from getsentry/prepare-release/9.16.1
• a1bdb3c meta(changelog): Update changelog for 9.16.1
• 22a0e35 fix(core): Make sure logs get flushed in server-runtime-client (#16222)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by sentry-bot, a new releaser for @​sentry/browser since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​sentry/​browser@​5.6.3 ⏵ 9.17.0	+2	+5	+9	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Warn		@sentry-internal/[email protected] has Network access. Module: globalThis["fetch"] Location: Package overview From: ? → npm/@sentry/[email protected] → npm/@sentry-internal/[email protected] ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry-internal/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		@sentry/[email protected] has Network access. Module: globalThis["fetch"] Location: Package overview From: ? → npm/@sentry/[email protected] → npm/@sentry/[email protected] ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report