Skip to content

Commit af9bd7e

Browse files
nicohrubecnicohrubec
authored
Merge branch 'develop' into nh/fix-vercel-message-truncation
2 parents ffb7817 + b9fbb9c commit af9bd7e

File tree

356 files changed

+7925
-3673
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

356 files changed

+7925
-3673
lines changed

‎.claude/skills/add-cdn-bundle/SKILL.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
name: add-cdn-bundle
3+
description: Create a new CDN bundle for the browser package with specified features
4+
argument-hint: <feature-combo> (e.g., replay.logs.metrics, tracing.logs, tracing.replay.feedback.logs.metrics)
5+
---
6+
7+
# Add CDN Bundle Skill
8+
9+
This skill creates a new CDN bundle for the browser package that includes a specific combination of features.
10+
11+
## Input
12+
13+
The user provides a feature combination using dot notation:
14+
15+
- `logs.metrics` - Bundle with logs and metrics
16+
- `replay.logs.metrics` - Bundle with replay, logs, and metrics
17+
- `tracing.replay.logs` - Bundle with tracing, replay, and logs
18+
- `tracing.replay.feedback.logs.metrics` - Full featured bundle
19+
20+
**Feature order in bundle names:** `tracing` → `replay` → `feedback` → `logs` → `metrics`
21+
22+
## Instructions
23+
24+
Follow the detailed guide at [docs/adding-cdn-bundle.md](../../../docs/adding-cdn-bundle.md) to create the bundle.
25+
26+
### Quick Reference - Naming Conventions
27+
28+
Given a feature combination, derive these variants:
29+
30+
| Placeholder | Example (`replay.logs.metrics`) |
31+
| ------------------------------- | ------------------------------- |
32+
| `{FEATURE_COMBO}` | `replay.logs.metrics` |
33+
| `{feature_combo}` | `replay_logs_metrics` |
34+
| `{featureCombo}` | `replayLogsMetrics` |
35+
| `{Human Readable Features}` | `Replay, Logs, Metrics` |
36+
| `{Human Readable Feature List}` | `Replay, Logs, and Metrics` |
37+
38+
### Quick Reference - Files to Create/Modify
39+
40+
1. **Create** `packages/browser/src/index.bundle.{FEATURE_COMBO}.ts`
41+
2. **Create** `packages/browser/test/index.bundle.{FEATURE_COMBO}.test.ts`
42+
3. **Modify** `packages/browser/rollup.bundle.config.mjs`
43+
4. **Modify** `.size-limit.js`
44+
5. **Modify** `dev-packages/browser-integration-tests/package.json`
45+
6. **Modify** `dev-packages/browser-integration-tests/utils/generatePlugin.ts`
46+
7. **Modify** `.github/workflows/build.yml`
47+
48+
### Verification Steps
49+
50+
After making changes:
51+
52+
```bash
53+
yarn lint
54+
cd packages/browser && yarn build:dev
55+
cd packages/browser && yarn test
56+
```

‎.claude/skills/fix-security-vulnerability/SKILL.md‎

Lines changed: 232 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
---
2+
name: fix-security-vulnerability
3+
description: Analyze and propose fixes for Dependabot security alerts
4+
argument-hint: <dependabot-alert-url>
5+
---
6+
7+
# Fix Security Vulnerability Skill
8+
9+
Analyze Dependabot security alerts and propose fixes. **Does NOT auto-commit** - always presents analysis first and waits for user approval.
10+
11+
## Input
12+
13+
- Dependabot URL: `https://github.com/getsentry/sentry-javascript/security/dependabot/1046`
14+
- Or just the alert number: `1046`
15+
16+
## Workflow
17+
18+
### Step 1: Fetch Vulnerability Details
19+
20+
```bash
21+
gh api repos/getsentry/sentry-javascript/dependabot/alerts/<alert-number>
22+
```
23+
24+
Extract: package name, vulnerable/patched versions, CVE ID, severity, description.
25+
26+
### Step 2: Analyze Dependency Tree
27+
28+
```bash
29+
yarn why <package-name>
30+
```
31+
32+
Determine if it's a direct or transitive dependency, and whether it's production or dev.
33+
34+
### Step 3: Determine Fix Strategy
35+
36+
#### Check for version-specific test packages
37+
38+
Many packages in `dev-packages/e2e-tests/test-applications/` intentionally pin specific versions:
39+
40+
- `nextjs-13` - Tests Next.js 13.x, should NOT bump to 14
41+
- `remix-2` - Tests Remix 2.x specifically
42+
43+
**Do NOT bump these.** Recommend dismissing the alert with an explanation.
44+
45+
#### For other dependencies
46+
47+
| Type | Action |
48+
| --------------------- | ----------------------------------- |
49+
| Patch bump available | Preferred - lowest risk |
50+
| Minor bump needed | Usually safe |
51+
| Major bump needed | Analyze breaking changes first |
52+
| Transitive dependency | Bump the parent package (see below) |
53+
54+
### Step 3a: Transitive Dependencies
55+
56+
If the vulnerable package is pulled in by another package:
57+
58+
**1. Identify and check the parent:**
59+
60+
```bash
61+
yarn why <vulnerable-package>
62+
npm view <parent-package>@latest dependencies.<vulnerable-package>
63+
```
64+
65+
**2. Fix approach:**
66+
67+
| Scenario | Action |
68+
| --------------------------------- | ------------------------------- |
69+
| Parent has newer version with fix | **Bump the parent** |
70+
| Parent hasn't released fix | Wait, or open an issue upstream |
71+
| We control the parent | Fix in parent package first |
72+
73+
**AVOID RESOLUTIONS.** Using `resolutions` to force a transitive dependency version is risky - it can break the parent package silently. Only consider resolutions if:
74+
75+
- No upstream fix exists AND it's a production-critical vulnerability
76+
- The forced version is a patch/minor bump (not major)
77+
- You've manually verified compatibility
78+
79+
In most cases, it's better to wait for an upstream fix or accept the risk for dev-only dependencies than to use resolutions.
80+
81+
### Step 4: Present Analysis
82+
83+
Present findings and **wait for user approval** before making changes:
84+
85+
```
86+
## Security Vulnerability Analysis
87+
88+
**Package:** <name> | **Severity:** <severity> | **CVE:** <id>
89+
**Vulnerable:** <range> | **Patched:** <version>
90+
91+
### Dependency Chain
92+
<yarn why output>
93+
94+
### Recommendation
95+
<One of: Safe to bump / Version-specific test - do not bump / Bump parent package>
96+
97+
### Proposed Fix
98+
1. Update <file>: "<package>": "<new-version>"
99+
2. yarn install && yarn dedupe-deps:fix
100+
3. Verify with: yarn why <package>
101+
102+
Proceed?
103+
```
104+
105+
### Step 5: Apply Fix (After Approval)
106+
107+
```bash
108+
# 1. Edit package.json
109+
# 2. Update lockfile
110+
yarn install
111+
# 3. Deduplicate
112+
yarn dedupe-deps:fix
113+
# 4. Verify
114+
yarn dedupe-deps:check
115+
yarn why <package>
116+
# 5. Show changes
117+
git diff
118+
```
119+
120+
**Do NOT commit** - let the user review first.
121+
122+
### Step 5 (Alternative): Dismiss Alert
123+
124+
For alerts that should not be fixed (e.g., version-specific test packages), offer to dismiss instead.
125+
126+
**Always get user approval first.** Present the dismissal option:
127+
128+
```
129+
This alert should be dismissed rather than fixed because:
130+
- <reason: version-specific test / dev-only acceptable risk / etc.>
131+
132+
Dismiss with reason: <suggested reason>
133+
Comment: "<suggested comment>"
134+
135+
Proceed with dismissal?
136+
```
137+
138+
**After user approval**, dismiss via GitHub API:
139+
140+
```bash
141+
gh api --method PATCH repos/getsentry/sentry-javascript/dependabot/alerts/<number> \
142+
-f state=dismissed \
143+
-f dismissed_reason=<reason> \
144+
-f dismissed_comment="<comment>"
145+
```
146+
147+
**Dismissal reasons:**
148+
149+
| Reason | When to use |
150+
| ---------------- | -------------------------------------------- |
151+
| `tolerable_risk` | Dev-only dependency, risk accepted |
152+
| `no_bandwidth` | Will fix later, not urgent |
153+
| `inaccurate` | False positive, not actually vulnerable |
154+
| `not_used` | Vulnerable code path is not used in our code |
155+
156+
## Commands Reference
157+
158+
| Command | Purpose |
159+
| ------------------------------------------------------------------------------------------------- | ---------------------------- |
160+
| `yarn why <pkg>` | Show dependency tree |
161+
| `yarn dedupe-deps:fix` | Fix duplicates in yarn.lock |
162+
| `yarn dedupe-deps:check` | Verify no duplicate issues |
163+
| `gh api repos/getsentry/sentry-javascript/dependabot/alerts/<n>` | Fetch alert |
164+
| `gh api --method PATCH .../dependabot/alerts/<n> -f state=dismissed -f dismissed_reason=<reason>` | Dismiss alert |
165+
| `npm view <pkg>@latest dependencies.<dep>` | Check transitive dep version |
166+
167+
## Examples
168+
169+
### Dev dependency - safe to bump
170+
171+
```
172+
Package: mongoose
173+
Location: dev-packages/node-integration-tests/package.json
174+
Type: Dev dependency (tests OTel instrumentation)
175+
176+
Recommendation: Safe to bump 5.x → 6.x
177+
- Not version-specific, just tests instrumentation works
178+
- OTel instrumentation supports mongoose 5.x-8.x
179+
```
180+
181+
### Version-specific test - dismiss instead
182+
183+
```
184+
Package: next
185+
Location: dev-packages/e2e-tests/test-applications/nextjs-13/package.json
186+
187+
Recommendation: DISMISS (do not bump)
188+
This app specifically tests Next.js 13 compatibility.
189+
Vulnerability only affects CI, not shipped code.
190+
191+
Proposed dismissal:
192+
Reason: tolerable_risk
193+
Comment: "Version-specific E2E test for Next.js 13 - intentionally pinned"
194+
195+
Proceed with dismissal?
196+
```
197+
198+
### Transitive dependency - bump parent
199+
200+
```
201+
Package: vulnerable-lib@1.9.0 (needs >=2.0.1)
202+
Chain: @sentry/node → @otel/instrumentation-foo@0.45.0 → vulnerable-lib
203+
204+
Check: npm view @otel/instrumentation-foo@latest dependencies.vulnerable-lib
205+
Result: "^2.0.1" ✓
206+
207+
Recommendation: Bump @otel/instrumentation-foo 0.45.0 → 0.47.0
208+
This pulls in the patched vulnerable-lib automatically.
209+
```
210+
211+
### Transitive dependency - no fix available
212+
213+
```
214+
Package: deep-lib@2.9.0 (needs >=3.0.0)
215+
Chain: @sentry/node → parent-pkg → middleware → deep-lib
216+
217+
No upstream fix available yet. Options:
218+
1. Wait for upstream fix (preferred)
219+
2. Accept risk if dev-only
220+
3. Consider alternative package if production-critical
221+
222+
AVOID using resolutions unless absolutely necessary.
223+
```
224+
225+
## Important Notes
226+
227+
- **Never auto-commit** - Always wait for user review
228+
- **Version-specific tests should not be bumped** - They exist to test specific versions
229+
- **Dev vs Prod matters** - Dev-only vulnerabilities are lower priority
230+
- **Bump parents, not transitive deps** - If A depends on vulnerable B, bump A
231+
- **Avoid resolutions** - They bypass the parent's dependency constraints and can cause subtle breakage
232+
- **Always verify** - Run `yarn why <pkg>` after fixing to confirm the patched version is installed

‎.cursor/BUGBOT.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,8 @@ Do not flag the issues below if they appear in tests.
5858
- Flag usage of `expect.objectContaining` and other relaxed assertions, when a test expects something NOT to be included in a payload but there's no respective assertion.
5959
- Flag usage of conditionals in one test and recommend splitting up the test for the different paths.
6060
- Flag usage of loops testing multiple scenarios in one test and recommend using `(it)|(test).each` instead.
61+
62+
## Platform-safe code
63+
64+
- When any `setTimeout` or `setInterval` timers are started in a code path that can end up in server runtime packages (e.g. `@sentry/core` or `@sentry/node`), flag if neither `timeout.unref()` nor `safeUnref()` are called.
65+
Not unref'ing a timer can keep CLI-like applications or node scripts from exiting immediately, due to the process waiting on timers started by the SDK.

‎.cursor/commands/add_cdn_bundle.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Add CDN Bundle for `{FEATURE_COMBO}`
2+
3+
Create a new CDN bundle for the browser package that includes `{FEATURE_COMBO}` (e.g., `replay.logs.metrics`, `tracing.logs`, etc.).
4+
5+
## Instructions
6+
7+
Follow the detailed guide at [docs/adding-cdn-bundle.md](../../docs/adding-cdn-bundle.md) to create the bundle.
8+
9+
## Quick Reference - Naming Conventions
10+
11+
| Placeholder | Example (`replay.logs.metrics`) |
12+
| ------------------------------- | ------------------------------- |
13+
| `{FEATURE_COMBO}` | `replay.logs.metrics` |
14+
| `{feature_combo}` | `replay_logs_metrics` |
15+
| `{featureCombo}` | `replayLogsMetrics` |
16+
| `{Human Readable Features}` | `Replay, Logs, Metrics` |
17+
| `{Human Readable Feature List}` | `Replay, Logs, and Metrics` |
18+
19+
## Quick Reference - Files to Create/Modify
20+
21+
1. **Create** `packages/browser/src/index.bundle.{FEATURE_COMBO}.ts`
22+
2. **Create** `packages/browser/test/index.bundle.{FEATURE_COMBO}.test.ts`
23+
3. **Modify** `packages/browser/rollup.bundle.config.mjs`
24+
4. **Modify** `.size-limit.js`
25+
5. **Modify** `dev-packages/browser-integration-tests/package.json`
26+
6. **Modify** `dev-packages/browser-integration-tests/utils/generatePlugin.ts`
27+
7. **Modify** `.github/workflows/build.yml`
28+
29+
## Verification Steps
30+
31+
After making changes:
32+
33+
1. Run `yarn lint` to check for linting issues
34+
2. Run `cd packages/browser && yarn build:dev` to verify TypeScript compilation
35+
3. Run `cd packages/browser && yarn test` to run the unit tests

0 commit comments

Comments
 (0)