[dependabot]

Bumps the npm group with 80 updates in the / directory:

Package	From	To
@arborium/arborium	2.18.1	2.18.2
@atlaskit/pragmatic-drag-and-drop	3.0.0	4.0.0
@atlaskit/pragmatic-drag-and-drop-auto-scroll	3.0.1	3.2.1
@atlaskit/pragmatic-drag-and-drop-hitbox	2.1.0	3.0.0
@choochmeque/tauri-plugin-sharekit-api	0.4.0-rc.5	0.4.0-rc.7
@lottiefiles/dotlottie-react	0.19.14	0.20.0
@lottiefiles/dotlottie-web	0.79.1	0.81.0
@matrix-org/matrix-sdk-crypto-wasm	18.4.0	18.9.0
@noble/hashes	2.3.0	2.4.0
@rolldown/plugin-node-polyfills	1.0.3	1.0.4
@sableclient/tauri-plugin-livekit-mobile	0.2.0	0.7.0
@sentry/react	10.70.0	11.9.0
@tanstack/react-query	5.101.4	5.104.5
@tanstack/react-query-devtools	5.101.4	5.104.5
@tanstack/react-virtual	3.14.9	3.14.22
@tauri-apps/api	2.11.1	2.12.4
@tauri-apps/plugin-clipboard-manager	2.3.2	2.5.0
@tauri-apps/plugin-deep-link	2.4.9	2.6.2
@tauri-apps/plugin-dialog	2.7.2	2.8.3
@tauri-apps/plugin-fs	2.5.1	2.7.1
@tauri-apps/plugin-geolocation	2.3.3	2.5.0
@tauri-apps/plugin-http	2.5.9	2.8.3
@tauri-apps/plugin-opener	2.5.4	2.7.2
@tauri-apps/plugin-os	2.3.2	2.4.0
@tauri-apps/plugin-process	2.3.1	2.4.0
@tauri-apps/plugin-store	2.4.4	2.5.0
@tauri-apps/plugin-updater	2.10.1	2.14.0
@vanilla-extract/css	1.21.2	1.21.3
dompurify	3.4.13	3.4.17
emojibase	17.0.0	18.0.0
emojibase-data	17.0.0	18.0.0
folds	2.7.1	2.7.3
html-react-parser	6.1.7	6.1.9
i18next	26.3.6	26.5.11
i18next-browser-languagedetector	8.2.1	8.2.3
i18next-http-backend	4.0.1	4.0.6
immer	11.1.17	11.2.9
jotai	2.20.2	3.0.1
katex	0.18.4	0.19.1
linkify-react	4.3.3	4.4.0
linkifyjs	4.3.3	4.4.0
livekit-client	2.22.0	2.23.0
marked	18.0.9	18.1.1
matrix-js-sdk	42.3.0	44.0.0
matrix-widget-api	1.18.0	1.20.0
nanoid	6.0.1	6.0.2
pdfjs-dist	6.2.108	6.4.299
prosemirror-history	1.5.0	1.5.1
prosemirror-model	1.25.11	1.25.12
prosemirror-view	1.42.2	1.42.8
react	19.2.8	19.3.1
@types/react	19.2.18	19.3.0
react-aria	3.51.0	3.53.1
react-colorful	5.8.0	5.8.1
react-dom	19.2.8	19.3.1
@types/react-dom	19.2.4	19.3.0
react-i18next	17.0.11	17.1.9
react-router	8.3.0	8.5.0
tauri-plugin-android-fs-api	29.0.0	30.2.0
virtua	0.50.1	0.53.6
@playwright/test	1.62.1	1.64.1
@sentry/vite-plugin	5.4.0	11.9.0
@tauri-apps/cli	2.11.4	2.12.4
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.4	14.6.8
@types/chroma-js	3.1.2	3.1.3
@types/node	26.2.0	26.6.5
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0
@vitejs/plugin-react	6.0.5	6.1.2
@vitest/coverage-v8	4.1.10	5.0.5
@vitest/ui	4.1.10	5.0.5
fake-indexeddb	6.2.5	6.2.6
jsdom	30.0.1	30.1.3
knip	6.32.2	6.43.0
oxfmt	0.63.0	0.74.0
oxlint	1.78.0	1.89.0
oxlint-tsgolint	7.0.2001	7.0.2005
testcontainers	12.1.0	12.2.1
vite	8.2.1	8.3.5
vite-plugin-pwa	1.3.0	2.0.0
vitest	4.1.10	5.0.5

Updates @arborium/arborium from 2.18.1 to 2.18.2

Commits

• See full diff in compare view

Updates @atlaskit/pragmatic-drag-and-drop from 3.0.0 to 4.0.0

Commits

• See full diff in compare view

Updates @atlaskit/pragmatic-drag-and-drop-auto-scroll from 3.0.1 to 3.2.1

Commits

• See full diff in compare view

Updates @atlaskit/pragmatic-drag-and-drop-hitbox from 2.1.0 to 3.0.0

Commits

• See full diff in compare view

Updates @choochmeque/tauri-plugin-sharekit-api from 0.4.0-rc.5 to 0.4.0-rc.7

Release notes

Sourced from @​choochmeque/tauri-plugin-sharekit-api's releases.

v0.4.0-rc.7

Maintenance release — dependency, CI and example-app updates only; no functional changes to the plugin API.

Changes

• Widen the clippy allow on the desktop stubs share_text / share_file to unknown_lints, clippy::unused_async, clippy::unused_async_trait_impl; lint compatibility only, the stubs still return Error::UnsupportedPlatform (5443132)

Build & tooling

• Kotlin Gradle plugin 1.9.25 → 2.1.21 for the Android example (bbbcb20)
• CI: Node 24 in every workflow (2d568b1)
• CI: refresh the apt index before cache-apt-pkgs-action, add libglib2.0-dev to the package list and bump the apt cache key to 1.2 (8806dee, 1d634f7)
• CI: forward ANDROID_NDK_LATEST_HOME into NDK_HOME / ANDROID_NDK_HOME at shell runtime for the Android demo build; pin Xcode 26.5 and drop MetalToolchain for the iOS demo build (62fede7)
• CI: publish.yml apt setup aligned with checks.yml — index refresh, libglib2.0-dev, cache key 1.2 (#245)
• Security advisories resolved in transitive dependencies: picomatch, and serde_with / tauri in the example app (#244)

Dependencies

• eslint 10.4.1 → 10.9.1, typescript-eslint 8.61.0 → 8.68.0, prettier 3.8.4 → 3.9.6, rollup 4.61.1 → 4.63.1, eslint-plugin-security 4.0.0 → 4.0.1
• actions/checkout 6 → 7, actions/setup-node 6 → 7, actions/setup-java 5 → 6
• example app: vite 8.0.16 → 8.2.2, @​sveltejs/kit 2.65.0 → 2.70.3, @​sveltejs/vite-plugin-svelte 7.1.2 → 7.3.0, svelte 5.56.3 → 5.56.10, svelte-check 4.6.0 → 4.7.6, @​tauri-apps/cli 2.11.2 → 2.11.4, @​tauri-apps/api 2.11.0 → 2.11.1, picomatch 4.0.4 → 4.0.7
• example app (Cargo): tauri 2.11.0 → 2.11.1, serde_with 3.16.1 → 3.21.0
• example app (Gradle): androidx.webkit:webkit 1.14.0 → 1.17.0

Full changelog: Choochmeque/tauri-plugin-sharekit@v0.4.0-rc.5...v0.4.0-rc.7

Commits

• c2a9cc3 Bump version to 0.4.0-rc.7
• 92eb711 Merge pull request #246 from Choochmeque/ci/publish-pnpm
• f523645 Pin the npm self-update to major 11
• aa6a33b Bump version to 0.4.0-rc.6
• 6ce6b60 Merge pull request #245 from Choochmeque/fix/publish-apt
• 5f53b95 Align publish.yml apt setup with checks.yml
• 7d2256d Merge pull request #244 from Choochmeque/chore/advisories-20260830
• 13f9c1f Resolve security advisories in example app dependencies (serde_with, tauri)
• a9e81b6 Resolve security advisories in dependencies (picomatch)
• 14c262d Merge pull request #235 from Choochmeque/dependabot/npm_and_yarn/eslint-10.9.1
• Additional commits viewable in compare view

Updates @lottiefiles/dotlottie-react from 0.19.14 to 0.20.0

Release notes

Sourced from @​lottiefiles/dotlottie-react's releases.

@​lottiefiles/dotlottie-react@​0.20.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

Patch Changes

• 629eb6c: Avoid loading the initial src twice when the React player is mounted. Both the regular and worker players now rely on their constructor to load the first animation, while later src changes still call load.
• Updated dependencies [e46482e]
  • @​lottiefiles/dotlottie-web@​0.81.0

@​lottiefiles/dotlottie-react@​0.19.16

Patch Changes

• Updated dependencies [0874fae]
• Updated dependencies [727add3]
  • @​lottiefiles/dotlottie-web@​0.80.0

@​lottiefiles/dotlottie-react@​0.19.15

Patch Changes

• Updated dependencies [14aee74]
  • @​lottiefiles/dotlottie-web@​0.79.2

Changelog

Sourced from @​lottiefiles/dotlottie-react's changelog.

0.20.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

Patch Changes

• 629eb6c: Avoid loading the initial src twice when the React player is mounted. Both the regular and worker players now rely on their constructor to load the first animation, while later src changes still call load.
• Updated dependencies [e46482e]
  • @​lottiefiles/dotlottie-web@​0.81.0

0.19.16

Patch Changes

• Updated dependencies [0874fae]
• Updated dependencies [727add3]
  • @​lottiefiles/dotlottie-web@​0.80.0

0.19.15

Patch Changes

• Updated dependencies [14aee74]
  • @​lottiefiles/dotlottie-web@​0.79.2

Commits

• e34f2cf chore: update versions (#971)
• 629eb6c fix(react): avoid reloading initial animation source (#977)
• e46482e feat(web): add setWorkerUrl() for CSP-compatible worker loading (#968)
• bb5abcf chore: update versions (#964)
• 7f717f9 chore: update versions (#956)
• See full diff in compare view

Updates @lottiefiles/dotlottie-web from 0.79.1 to 0.81.0

Release notes

Sourced from @​lottiefiles/dotlottie-web's releases.

@​lottiefiles/dotlottie-web@​0.81.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

@​lottiefiles/dotlottie-web@​0.80.0

Minor Changes

• 0874fae: feat: add experimental support for MP4 video assets in dotLottie files

Patch Changes

• 727add3: fix: setWasmUrl() disables the jsdelivr/unpkg fallback instead of still reaching unpkg when the configured URL fails; DotLottieWorker.setWasmUrl() resolves relative URLs against the page (the blob worker can't) and reaches workers that exist but haven't started loading

@​lottiefiles/dotlottie-web@​0.79.2

Patch Changes

• 14aee74: Update dotlottie-rs WASM bindings to 0f16fb8.

Changelog

Sourced from @​lottiefiles/dotlottie-web's changelog.

0.81.0

Minor Changes

• e46482e: feat: add DotLottieWorker.setWorkerUrl() for CSP-compatible worker loading

  Ship dist/dotlottie.worker.js as a standalone file and add setWorkerUrl(url) so consumers can self-host the worker script, avoiding worker-src: blob: in Content-Security-Policy.

  Relative src paths are now resolved against the page before reaching the worker.

0.80.0

Minor Changes

• 0874fae: feat: add experimental support for MP4 video assets in dotLottie files

Patch Changes

• 727add3: fix: setWasmUrl() disables the jsdelivr/unpkg fallback instead of still reaching unpkg when the configured URL fails; DotLottieWorker.setWasmUrl() resolves relative URLs against the page (the blob worker can't) and reaches workers that exist but haven't started loading

0.79.2

Patch Changes

• 14aee74: Update dotlottie-rs WASM bindings to 0f16fb8.

Commits

• e34f2cf chore: update versions (#971)
• e46482e feat(web): add setWorkerUrl() for CSP-compatible worker loading (#968)
• bb5abcf chore: update versions (#964)
• 0874fae feat: video assets in dotLottie files (#958)
• 727add3 fix(web): make setWasmUrl opt out of the CDN fallback (#962)
• 7f717f9 chore: update versions (#956)
• 14aee74 chore: update dotlottie-rs wasm bindings to 0f16fb8 (#955)
• See full diff in compare view

Updates @matrix-org/matrix-sdk-crypto-wasm from 18.4.0 to 18.9.0

Release notes

Sourced from @​matrix-org/matrix-sdk-crypto-wasm's releases.

v18.9.0

matrix-sdk-crypto-wasm v18.9.0

• Update matrix-rust-sdk to 0.19.1

  • (No significant changes for matrix-rust-sdk-crypto)

• Update matrix-rust-sdk to 0.19.0

  • (No significant changes for matrix-rust-sdk-crypto)

v18.8.0

matrix-sdk-crypto-wasm v18.8.0

• Update matrix-rust-sdk to 6bcb11f

  • [breaking] Sas::emoji() and Sas::emoji_index() now return None when the emoji method was not part of the negotiated short authentication string methods, instead of returning an emoji representation the remote side never agreed to display. Previously a client that offered only the (mandatory) decimal method would negotiate ["decimal"] in the m.key.verification.accept event, yet a peer built on this crate would still be handed emoji and could show them to its user — leaving the two users comparing a decimal string against emoji, two incomparable projections of the same SAS bytes.

  • A user identity whose master key carries a valid X.509 signature chaining to one of the configured trust anchors now confers trust on that user's devices.

    Previously, such an identity was reported as verified by UserIdentity::is_verified(), but its devices would still be reported as unverified by Device::is_verified(), and the room key sharing strategies withheld room keys from them.

    Requires the experimental-x509-identity-verification feature and a configured X.509 verifier.

  • [breaking] Removed OwnUserIdentityData::is_identity_verified().

    This method asked whether we had verified another user's identity from the perspective of our own identity, and so only ever considered cross-signing.

    Use UserIdentity::is_verified() or OtherUserIdentity::is_verified() instead, which account for every root of trust we have in that identity, including an X.509 signature on its master key.

v18.7.0

matrix-sdk-crypto-wasm v18.7.0

• Add OlmMachine.receiveSyncChangesMsc4186, for processing the encryption state from a simplified sliding sync (MSC4186) response. It behaves like receiveSyncChanges, except that a missing one-time key count means "unchanged" rather than "zero keys on the server". (#345)

• Update matrix-rust-sdk to f333a32.

v18.6.0

matrix-sdk-crypto-wasm v18.6.0

• Allow providing rawX509Signer and rawX509Validity to OlmMachine::initialize and OlmMachine::initFromStore, allowing the user's identity to be signed using the supplied JavaScript function. Both the signer and validity function must be supplied, or neither. #341

... (truncated)

Changelog

Sourced from @​matrix-org/matrix-sdk-crypto-wasm's changelog.

matrix-sdk-crypto-wasm v18.9.0

• Update matrix-rust-sdk to 0.19.1

  • (No significant changes for matrix-rust-sdk-crypto)

• Update matrix-rust-sdk to 0.19.0

  • (No significant changes for matrix-rust-sdk-crypto)

matrix-sdk-crypto-wasm v18.8.0

• Update matrix-rust-sdk to 6bcb11f

  • [breaking] Sas::emoji() and Sas::emoji_index() now return None when the emoji method was not part of the negotiated short authentication string methods, instead of returning an emoji representation the remote side never agreed to display. Previously a client that offered only the (mandatory) decimal method would negotiate ["decimal"] in the m.key.verification.accept event, yet a peer built on this crate would still be handed emoji and could show them to its user — leaving the two users comparing a decimal string against emoji, two incomparable projections of the same SAS bytes.

  • A user identity whose master key carries a valid X.509 signature chaining to one of the configured trust anchors now confers trust on that user's devices.

    Previously, such an identity was reported as verified by UserIdentity::is_verified(), but its devices would still be reported as unverified by Device::is_verified(), and the room key sharing strategies withheld room keys from them.

    Requires the experimental-x509-identity-verification feature and a configured X.509 verifier.

  • [breaking] Removed OwnUserIdentityData::is_identity_verified().

    This method asked whether we had verified another user's identity from the perspective of our own identity, and so only ever considered cross-signing.

    Use UserIdentity::is_verified() or OtherUserIdentity::is_verified() instead, which account for every root of trust we have in that identity, including an X.509 signature on its master key.

matrix-sdk-crypto-wasm v18.7.0

• Add OlmMachine.receiveSyncChangesMsc4186, for processing the encryption state from a simplified sliding sync (MSC4186) response. It behaves like receiveSyncChanges, except that a missing one-time key count means "unchanged" rather than "zero keys on the server".

... (truncated)

Commits

• a3d573d v18.9.0
• 861b2fd Changelog for v18.9.0
• 2b7c4f9 Update dependencies with 'cargo update'
• 76a31f0 Bump to matrix-rust-sdk to 0.19.0
• 3c9a071 Merge pull request #347 from matrix-org/release-v18.8.0
• c403153 v18.8.0
• aa0235e chore: Reformat with nightly rustfmt
• 81dfdef chore: Update README for v18.8.0
• e5b1c8b chore: Bump matrix-rust-sdk to 6bcb11f
• 6f728f8 Merge pull request #346 from matrix-org/release-v18.7.0
• Additional commits viewable in compare view

Updates @noble/hashes from 2.3.0 to 2.4.0

Release notes

Sourced from @​noble/hashes's releases.

2.4.0

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Full Changelog: paulmillr/noble-hashes@2.3.0...2.4.0

Changelog

Sourced from @​noble/hashes's changelog.

2.4.0 (2026-08-27)

Security and correctness

• Protect passed options against mutation / pollution
• keccakprg: fail until entropy is added
• webcrypto: reject output sizes which crashed engine
• blake3: fix tree merging for multi-terabyte streams
• Improve zeroization

Misc

• Speed-up Argon2 by 20%
• Argon2 cost options are now optional. The defaults are t: 3, m: 1024 ** 2 KiB (1 GiB), p: 1, dkLen: 32, and a 1 GiB maxmem limit; larger-memory calls must set maxmem explicitly.
• Corrected scrypt's default maxmem to work for N: 2 ** 20, r: 8, and p: 1
• nextTick and asyncLoop now yield through scheduler.yield() when available or setTimeout otherwise, allowing timers, I/O, and rendering to progress. They also accept optional rejection cleanup; async Argon2, PBKDF2, and scrypt use it to wipe work state if scheduling is aborted.

Commits

• 663c2ae Release 2.4.0.
• a6f7519 Add changelog
• 1bbc433 webcrypto: snapshot opts
• 5bd2e15 Remove unused files
• a3bc7ff Bump vectors
• fcb6cb6 README
• 64f3033 readme
• 9ac6165 Bump ci workflows
• 6587b51 Fix test on bun
• 91ecf91 Fix tests
• Additional commits viewable in compare view

Updates @rolldown/plugin-node-polyfills from 1.0.3 to 1.0.4

Commits

• 83da501 1.0.4
• f7269e6 fix: polyfill node: prefixed built-in imports (#55)
• 538828c chore(deps): update oxc apps (#50)
• 60c96c5 chore(deps): update vitest to 4.1.12 and add vite 8 (#58)
• b4df7df chore: bump root pnpm to 11.1.2 (#48)
• c5e0125 chore(deps): update oxc apps (#47)
• 018a6a5 chore(deps): update oxc apps (#45)
• 0d67b67 chore(deps): update oxc apps (#44)
• de01dcb chore(deps): update dependency rolldown to v1.0.0 (#43)
• a60f437 chore(deps): update oxc apps (#41)
• Additional commits viewable in compare view

Updates @sableclient/tauri-plugin-livekit-mobile from 0.2.0 to 0.7.0

Release notes

Sourced from @​sableclient/tauri-plugin-livekit-mobile's releases.

v0.7.0

Full Changelog: SableClient/tauri-plugin-livekit-mobile@v0.6.0...v0.7.0

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.7.0

v0.6.0

Full Changelog: SableClient/tauri-plugin-livekit-mobile@v0.5.0...v0.6.0

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.6.0

v0.5.0

Choose the microphone during an Android call

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.5.0

v0.4.0

Adds microphone processing and per-participant playout volume to the native call bridge.

Added

• setNativeCallAudioProcessing — echo cancellation, noise suppression and automatic gain control, applied to the live microphone track rather than only the next call.
• setNativeCallParticipantVolume — per-identity playout gain. 0 mutes, 1 is unity, and both platform SDKs clamp at 10.
• connectNativeCall takes an optional audioProcessing block. Omitted means every effect on, which is both SDKs' own default, so an existing guest is unchanged.

Gains are re-applied on TrackSubscribed: a track arrives at unity gain, so a volume set before a participant publishes — or before a reconnect resubscribes them — would otherwise be lost.

NPM

pnpm add @sableclient/tauri-plugin-livekit-mobile@0.4.0

v0.3.0

What's Changed

• feat: expose reportIncomingCall for the system incoming-call screen by @​eleboucher in SableClient/tauri-plugin-livekit-mobile#1

New Contributors

• @​eleboucher made their first contribution in SableClient/tauri-plugin-livekit-mobile#1

... (truncated)

Commits

• e4c6767 feat(ios): start the outgoing CallKit call when connecting
• 26f2fcc fix(ios): disable CallKit for China storefronts
• dc1cc21 fix(android): ring incoming calls through notifications
• 8b8c96c fix: control remote screenshare audio separately from voice
• 1843c7d feat: render every remote video track in its own native view
• 7dd0dad fix: publish plain Opus when the call is end-to-end encrypted
• 96c96a2 fix(ios): export the plugin entry point on Xcode 27
• 12cc6f7 fix(ios): find the Swift library in Xcode 27's SwiftPM output
• a8a3645 fix(ios): raise deployment targets for Xcode 27
• ed71539 refactor(android): import RequiresApi and drop a field comment
• Additional commits viewable in compare view

Updates @sentry/react from 10.70.0 to 11.9.0

Release notes

Sourced from @​sentry/react's releases.

11.9.0

Important Changes

• feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

  Some span origins changed their names to match the other v11 origins:

  • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
  • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
  • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
  • auto.grpc.serverless is now auto.grpc.google_cloud.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(deno): Add incoming request options to denoServeIntegration (#25493)

  denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

  ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

• feat(deno): Record request sessions for Deno.serve (#25496)

  denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

• feat(deno): Register channel injection hooks from init() (#25546)

  Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

  On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

• feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(nextjs): Never emit trace meta tags from a prerender (#25141)

  Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

  If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

• feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

11.9.0

Important Changes

• feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

  Some span origins changed their names to match the other v11 origins:

  • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
  • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
  • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
  • auto.grpc.serverless is now auto.grpc.google_cloud.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(deno): Add incoming request options to denoServeIntegration (#25493)

  denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

  ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

• feat(deno): Record request sessions for Deno.serve (#25496)

  denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

• feat(deno): Register channel injection hooks from init() (#25546)

  Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

  On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

• feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(nextjs): Never emit trace meta tags from a prerender (#25141)

  Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

  If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

• feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

... (truncated)

Commits

• 7b8ce4f meta(changelog): Add cherry-picked PRs to 11.9.0 changelog
• 487097d ci: Stop uploading duplicate tarballs to the release artifact (#25688)
• 1276d41 fix(deps): Allow @opentelemetry/api 1.9 again (#25684)
• c74f77f test(nextjs): Bump nextjs-16 E2E app to Next.js 16.4.2 (#25686)
• 47dec2a release: 11.9.0
• cc40f95 Merge pull request #25628 from getsentry/prepare-release/11.9.0
• 4689484 meta(changelog): Update changelog for 11.9.0
• b94aeb0 fix(hono): Read connection info from the runtime instead of Hono helpers (#25...
• ded8524 test(e2e): Retry tests in all dev-mode variants (#25640)
• 24186f0 feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.101.4 to 5.104.5

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-devtools@​5.104.5

@​tanstack/react-query-next-experimental@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5

@​tanstack/react-query-persist-client@​5.104.5

Patch Changes

• Updated dependencies [1f8d134]:
  • @​tanstack/react-query@​5.104.5
  • @​tanstack/query-persist-client-core@​5.104.5

@​tanstack/react-query@​5.104.5

Patch Changes

• #12117 1f8d134 - Recompute useMutationState and useIsMutating results when their filters, selector, or query client change, without waiting for a mutation cache update.
• Updated dependencies [f608f93]:
  • @​tanstack/query-core@​5.104.5

@​tanstack/react-query-devtools@​5.104.4

Patch Changes

• #11722 0992a92 - fix(react-query-devtools): create the devtools instance only once instead of on every render

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency

• Updated dependencies [c8f5eac, c208861, b61abc2, a108398]:

  • @​tanstack/query-devtools@​5.104.4
  • @​tanstack/react-query@​5.104.4

@​tanstack/react-query-next-experimental@​5.104.4

Patch Changes

• #11728 a108398 - fix(react-query*): declare '@​types/react' as an optional peer dependency
• Updated dependencies [c208861, a108398]:
  <...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.