Merge remote-tracking branch 'upstream/develop' into patch-1

Author: SG60

.craft.yml

@@ -9,32 +9,27 @@ targets:
   - name: npm
     id: '@sentry/types'
     includeNames: /^sentry-types-\d.*\.tgz$/
-  ## 1.2 Utils
-  # TODO(v9): Remove
-  - name: npm
-    id: '@sentry/utils'
-    includeNames: /^sentry-utils-\d.*\.tgz$/
-  ## 1.3 Core SDK
+  ## 1.2 Core SDK
   - name: npm
     id: '@sentry/core'
     includeNames: /^sentry-core-\d.*\.tgz$/
-  ## 1.4 Browser Utils package
+  ## 1.3 Browser Utils package
   - name: npm
     id: '@sentry-internal/browser-utils'
     includeNames: /^sentry-internal-browser-utils-\d.*\.tgz$/
-  ## 1.5 Replay Internal package (browser only)
+  ## 1.4 Replay Internal package (browser only)
   - name: npm
     id: '@sentry-internal/replay'
     includeNames: /^sentry-internal-replay-\d.*\.tgz$/
-  ## 1.6 OpenTelemetry package
+  ## 1.5 OpenTelemetry package
   - name: npm
     id: '@sentry/opentelemetry'
     includeNames: /^sentry-opentelemetry-\d.*\.tgz$/
-  ## 1.7 Feedback package (browser only)
+  ## 1.6 Feedback package (browser only)
   - name: npm
     id: '@sentry-internal/feedback'
     includeNames: /^sentry-internal-feedback-\d.*\.tgz$/
-  ## 1.8 ReplayCanvas package (browser only)
+  ## 1.7 ReplayCanvas package (browser only)
   - name: npm
     id: '@sentry-internal/replay-canvas'
     includeNames: /^sentry-internal-replay-canvas-\d.*\.tgz$/
@@ -143,37 +138,20 @@ targets:
     includeNames: /^sentry-internal-eslint-config-sdk-\d.*\.tgz$/
 
   # AWS Lambda Layer target
-  - name: aws-lambda-layer
-    includeNames: /^sentry-node-serverless-\d+.\d+.\d+(-(beta|alpha|rc)\.\d+)?\.zip$/
-    layerName: SentryNodeServerlessSDK
-    compatibleRuntimes:
-      - name: node
-        versions:
-          - nodejs10.x
-          - nodejs12.x
-          - nodejs14.x
-          - nodejs16.x
-          - nodejs18.x
-          - nodejs20.x
-    license: MIT
-
-  # NOTE: We publish the v8 layer under its own name so people on v8 can still get patches
-  # whenever we release a new v8 version—otherwise we would overwrite the current major lambda layer.
-
-  # AWS Lambda Layer target
-  - name: aws-lambda-layer
-    includeNames: /^sentry-node-serverless-\d+.\d+.\d+(-(beta|alpha|rc)\.\d+)?\.zip$/
-    layerName: SentryNodeServerlessSDKv8
-    compatibleRuntimes:
-      - name: node
-        versions:
-          - nodejs10.x
-          - nodejs12.x
-          - nodejs14.x
-          - nodejs16.x
-          - nodejs18.x
-          - nodejs20.x
-    license: MIT
+  # TODO(v9): Once stable, re-add this target to publish the AWS Lambda layer
+  # - name: aws-lambda-layer
+  #   includeNames: /^sentry-node-serverless-\d+.\d+.\d+(-(beta|alpha|rc)\.\d+)?\.zip$/
+  #   layerName: SentryNodeServerlessSDK
+  #   compatibleRuntimes:
+  #     - name: node
+  #       versions:
+  #         - nodejs10.x
+  #         - nodejs12.x
+  #         - nodejs14.x
+  #         - nodejs16.x
+  #         - nodejs18.x
+  #         - nodejs20.x
+  #   license: MIT
 
   # CDN Bundle Target
   - name: gcs

.github/ISSUE_TEMPLATE/flaky.yml

@@ -19,7 +19,7 @@ body:
     id: job-name
     attributes:
       label: Name of Job
-      placeholder: "CI: Build & Test / Nextjs (Node 14) Tests"
+      placeholder: "CI: Build & Test / Nextjs (Node 18) Tests"
       description: name of job as reported in the status report
     validations:
       required: true

.github/actions/restore-cache/action.yml

@@ -5,9 +5,6 @@ inputs:
   dependency_cache_key:
     description: "The dependency cache key"
     required: true
-  node_version:
-    description: "If set, temporarily set node version to default one before installing, then revert to this version after."
-    required: false
 
 runs:
   using: "composite"
@@ -24,19 +21,7 @@ runs:
         with:
           name: build-output
 
-      - name: Use default node version for install
-        if: inputs.node_version && steps.dep-cache.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: 'package.json'
-
       - name: Install dependencies
         if: steps.dep-cache.outputs.cache-hit != 'true'
         run: yarn install --ignore-engines --frozen-lockfile
         shell: bash
-
-      - name: Revert node version to ${{ inputs.node_version }}
-        if: inputs.node_version && steps.dep-cache.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}

.github/dependency-review-config.yml

@@ -7,3 +7,5 @@ allow-ghsas:
   - GHSA-fr5h-rqp8-mj6g
   # we need this for an E2E test for the minimum required version of Nuxt 3.7.0
   - GHSA-v784-fjjh-f8r4
+  # Next.js Cache poisoning - We require a vulnerable version for E2E testing
+  - GHSA-gp8f-8m3g-qvj9

.github/workflows/build.yml

@@ -4,6 +4,8 @@ on:
     branches:
       - develop
       - master
+      - v9
+      - v8
       - release/**
   pull_request:
   merge_group:
@@ -105,7 +107,7 @@ jobs:
     outputs:
       commit_label: '${{ env.COMMIT_SHA }}: ${{ env.COMMIT_MESSAGE }}'
       # Note: These next three have to be checked as strings ('true'/'false')!
-      is_develop: ${{ github.ref == 'refs/heads/develop' }}
+      is_base_branch: ${{ github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/v9' || github.ref == 'refs/heads/v8'}}
       is_release: ${{ startsWith(github.ref, 'refs/heads/release/') }}
       changed_profiling_node: ${{ steps.changed.outputs.profiling_node == 'true' }}
       changed_ci: ${{ steps.changed.outputs.workflow == 'true' }}
@@ -126,7 +128,7 @@ jobs:
     timeout-minutes: 15
     if: |
       needs.job_get_metadata.outputs.changed_any_code == 'true' ||
-      needs.job_get_metadata.outputs.is_develop == 'true' ||
+      needs.job_get_metadata.outputs.is_base_branch == 'true' ||
       needs.job_get_metadata.outputs.is_release == 'true' ||
       (needs.job_get_metadata.outputs.is_gitflow_sync == 'false' && needs.job_get_metadata.outputs.has_gitflow_label == 'false')
     steps:
@@ -171,7 +173,7 @@ jobs:
           key: nx-Linux-${{ github.ref }}-${{ env.HEAD_COMMIT || github.sha }}
           # On develop branch, we want to _store_ the cache (so it can be used by other branches), but never _restore_ from it
           restore-keys:
-            ${{needs.job_get_metadata.outputs.is_develop == 'false' && env.NX_CACHE_RESTORE_KEYS || 'nx-never-restore'}}
+            ${{needs.job_get_metadata.outputs.is_base_branch == 'false' && env.NX_CACHE_RESTORE_KEYS || 'nx-never-restore'}}
 
       - name: Build packages
         # Set the CODECOV_TOKEN for Bundle Analysis
@@ -219,7 +221,7 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-20.04
     if:
-      github.event_name == 'pull_request' || needs.job_get_metadata.outputs.is_develop == 'true' ||
+      github.event_name == 'pull_request' || needs.job_get_metadata.outputs.is_base_branch == 'true' ||
       needs.job_get_metadata.outputs.is_release == 'true'
     steps:
       - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
@@ -457,7 +459,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [14, 16, 18, 20, 22]
+        node: [18, 20, 22]
     steps:
       - name: Check out base commit (${{ github.event.pull_request.base.sha }})
         uses: actions/checkout@v4
@@ -476,7 +478,6 @@ jobs:
         uses: ./.github/actions/restore-cache
         with:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
-          node_version: ${{ matrix.node == 14 && '14' || '' }}
 
       - name: Run affected tests
         run: yarn test:pr:node --base=${{ github.event.pull_request.base.sha }}
@@ -713,7 +714,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: [14, 16, 18, 20, 22]
+        node: [18, 20, 22]
         typescript:
           - false
         include:
@@ -733,17 +734,13 @@ jobs:
         uses: ./.github/actions/restore-cache
         with:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
-          node_version: ${{ matrix.node == 14 && '14' || '' }}
 
       - name: Overwrite typescript version
-        if: matrix.typescript
-        run: node ./scripts/use-ts-version.js ${{ matrix.typescript }}
+        if: matrix.typescript == '3.8'
+        run: node ./scripts/use-ts-3_8.js
         working-directory: dev-packages/node-integration-tests
 
       - name: Run integration tests
-        env:
-          NODE_VERSION: ${{ matrix.node }}
-          TS_VERSION: ${{ matrix.typescript }}
         working-directory: dev-packages/node-integration-tests
         run: yarn test
 
@@ -758,10 +755,6 @@ jobs:
       matrix:
         node: [18, 20, 22]
         remix: [1, 2]
-        # Remix v2 only supports Node 18+, so run 16 tests separately
-        include:
-          - node: 16
-            remix: 1
     steps:
       - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
         uses: actions/checkout@v4
@@ -1241,24 +1234,22 @@ jobs:
           echo "One of the dependent jobs have failed. You may need to re-run it." && exit 1
 
   job_compile_bindings_profiling_node:
-    name: Compile & Test Profiling Bindings (v${{ matrix.node }}) ${{ matrix.target_platform || matrix.os }}, ${{ matrix.node || matrix.container }}, ${{ matrix.arch || matrix.container }}, ${{ contains(matrix.container, 'alpine') && 'musl' || 'glibc'  }}
+    name: Compile profiling-node (v${{ matrix.node }}) ${{ matrix.target_platform || matrix.os }}, ${{ matrix.arch || matrix.container }}, ${{ contains(matrix.container, 'alpine') && 'musl' || 'glibc'  }}
     needs: [job_get_metadata, job_build]
     # Compiling bindings can be very slow (especially on windows), so only run precompile
     # Skip precompile unless we are on a release branch as precompile slows down CI times.
     if: |
       (needs.job_get_metadata.outputs.changed_profiling_node == 'true') ||
       (needs.job_get_metadata.outputs.is_release == 'true')
     runs-on: ${{ matrix.os }}
-    container: ${{ matrix.container }}
+    container:
+      image: ${{ matrix.container }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
         include:
             # x64 glibc
-          - os: ubuntu-20.04
-            node: 16
-            binary: linux-x64-glibc-93
           - os: ubuntu-20.04
             node: 18
             binary: linux-x64-glibc-108
@@ -1270,10 +1261,6 @@ jobs:
             binary: linux-x64-glibc-127
 
             # x64 musl
-          - os: ubuntu-20.04
-            container: node:16-alpine3.16
-            binary: linux-x64-musl-93
-            node: 16
           - os: ubuntu-20.04
             container: node:18-alpine3.17
             node: 18
@@ -1288,10 +1275,6 @@ jobs:
             binary: linux-x64-musl-127
 
             # arm64 glibc
-          - os: ubuntu-20.04
-            arch: arm64
-            node: 16
-            binary: linux-arm64-glibc-93
           - os: ubuntu-20.04
             arch: arm64
             node: 18
@@ -1306,11 +1289,6 @@ jobs:
             binary: linux-arm64-glibc-127
 
             # arm64 musl
-          - os: ubuntu-20.04
-            container: node:16-alpine3.16
-            arch: arm64
-            node: 16
-            binary: linux-arm64-musl-93
           - os: ubuntu-20.04
             arch: arm64
             container: node:18-alpine3.17
@@ -1328,10 +1306,6 @@ jobs:
             binary: linux-arm64-musl-127
 
             # macos x64
-          - os: macos-13
-            node: 16
-            arch: x64
-            binary: darwin-x64-93
           - os: macos-13
             node: 18
             arch: x64
@@ -1346,11 +1320,6 @@ jobs:
             binary: darwin-x64-127
 
             # macos arm64
-          - os: macos-13
-            arch: arm64
-            node: 16
-            target_platform: darwin
-            binary: darwin-arm64-93
           - os: macos-13
             arch: arm64
             node: 18
@@ -1368,10 +1337,6 @@ jobs:
             binary: darwin-arm64-127
 
             # windows x64
-          - os: windows-2022
-            node: 16
-            arch: x64
-            binary: win32-x64-93
           - os: windows-2022
             node: 18
             arch: x64
@@ -1397,8 +1362,13 @@ jobs:
         with:
           ref: ${{ env.HEAD_COMMIT }}
 
+      # Note: On alpine images, this does nothing
+      # The node version will be the one that is installed in the image
+      # If you want to change the node version, you need to change the image
+      # For non-alpine imgages, this will install the correct version of node
       - name: Setup Node
         uses: actions/setup-node@v4
+        if: contains(matrix.container, 'alpine') == false
         with:
           node-version: ${{ matrix.node }}
 
@@ -1415,10 +1385,10 @@ jobs:
         run: yarn config set network-timeout 600000 -g
 
       - name: Install dependencies
-        env:
-          SKIP_PLAYWRIGHT_BROWSER_INSTALL: "1"
         if: steps.restore-dependencies.outputs.cache-hit != 'true'
         run: yarn install --ignore-engines --frozen-lockfile
+        env:
+          SKIP_PLAYWRIGHT_BROWSER_INSTALL: "1"
 
       - name: Configure safe directory
         run: |
@@ -1496,8 +1466,7 @@ jobs:
           BUILD_ARCH=arm64 \
           yarn build:bindings:arm64
 
-      - name: Build Monorepo
-        if: steps.restore-build.outputs.cache-hit != 'true'
+      - name: Build profiling-node & its dependencies
         run: yarn build --scope @sentry/profiling-node
 
       - name: Test Bindings

.github/workflows/enforce-license-compliance.yml

@@ -2,9 +2,18 @@ name: "CI: Enforce License Compliance"
 
 on:
   push:
-    branches: [master, develop, release/*]
+    branches:
+      - develop
+      - master
+      - v9
+      - v8
+      - release/**
   pull_request:
-    branches: [master, develop]
+    branches:
+      - develop
+      - master
+      - v9
+      - v8
 
 jobs:
   enforce-license-compliance: