Skip to content

Bump the dependencies group with 5 updates - #90

Merged
grubersjoe merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-43df445b1b
Sep 2, 2026
Merged

Bump the dependencies group with 5 updates#90
grubersjoe merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-43df445b1b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 5 updates:

Package From To
@sentry/node 10.70.0 10.72.0
express-rate-limit 8.6.2 8.7.0
zod 4.4.3 4.5.2
eslint 10.9.0 10.9.1
typescript-eslint 8.67.0 8.68.0

Updates @sentry/node from 10.70.0 to 10.72.0

Release notes

Sourced from @​sentry/node's releases.

10.72.0

Important Changes

  • AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

    Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

  • feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

    The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

  • fix(v10/astro): support astro v7 route patterns properly (#23657)
  • fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
  • fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • fix(v10/node): Only end the process session when it is still ok (#23731)
  • fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
  • fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
  • fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
  • fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
  • fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)
  • chore(v10): Add external contributor to CHANGELOG.md (#23626)
  • docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
  • test(v10/e2e): Fix scripts for nuxt dev server (#23658)
  • test(v10/e2e): Look up events via the organization trace endpoint (#23680)
  • test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

Bundle size 📦

Path Size
@​sentry/browser 27.1 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.28 KB
@​sentry/browser (incl. Tracing, Profiling) 50.17 KB
@​sentry/browser (incl. Tracing, Replay) 83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.83 KB

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.72.0

Important Changes

  • AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

    Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

  • feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

    The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

  • fix(v10/astro): support astro v7 route patterns properly (#23657)
  • fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
  • fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • fix(v10/node): Only end the process session when it is still ok (#23731)
  • fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
  • fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
  • fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
  • fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
  • fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)
  • chore(v10): Add external contributor to CHANGELOG.md (#23626)
  • docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
  • test(v10/e2e): Fix scripts for nuxt dev server (#23658)
  • test(v10/e2e): Look up events via the organization trace endpoint (#23680)
  • test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

10.71.0

Important Changes

  • feat(v10/core)!: Enable logs by default (#23311)

The enableLogs client option now defaults to true, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call the Sentry.logger.* APIs or add a log-forwarding integration (such as consoleLoggingIntegration, pinoIntegration, or the winston transport), and you can set enableLogs: false to opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.

Other Changes

  • feat(v10/core): Deprecate scope.clear() method (#23231)
  • fix(v10/core): Bound child span tracking on long-lived spans (#23406)

... (truncated)

Commits
  • 0d23628 release: 10.72.0
  • ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
  • f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
  • 7917b0d feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737)
  • b61e912 fix(v10/node): Only end the process session when it is still ok (#23731)
  • 4316785 test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)
  • e09fdf8 fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
  • 817056d test(v10/e2e): Look up events via the organization trace endpoint (#23680)
  • 83c644d fix(v10/server-utils): Stop shipping orchestrion bundler plugins as productio...
  • 04a52dd fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
  • Additional commits viewable in compare view

Updates express-rate-limit from 8.6.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

Commits
  • 48db09e 8.7.0
  • dce5871 v8.7.0 changelog
  • 2f08044 Add inspect.software health badge (#673)
  • a29757c feat: add retryAfter option (#661)
  • 146e88b chore: rename license
  • 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
  • 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
  • 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
  • 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
  • 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
  • Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.2

Release notes

Sourced from zod's releases.

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";
const Player = z.object({
username: z.string(),
bio: z.string(),
xp: z.number(),
// ...20 more properties...
</tr></table>

... (truncated)

Commits
  • 9a193aa 4.5.2
  • 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
  • 652bb43 chore(docs): drop the scroll log from the route-change scroller
  • 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
  • 6635d9d docs(blog): soften the "method memoization" attribution
  • 6c932fc chore: bump devcontainer image to Node 24 (#6470)
  • fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
  • e7576f5 docs(blog): let the page show through the navbar in dark mode (#6489)
  • 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (...
  • d378c42 ci: drop canary publishing from the release workflow (#6487)
  • Additional commits viewable in compare view

Updates eslint from 10.9.0 to 10.9.1

Release notes

Sourced from eslint's releases.

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

Commits

Updates typescript-eslint from 8.67.0 to 8.68.0

Release notes

Sourced from typescript-eslint's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

  • eslint-plugin: [strict-void-return] add fix suggestions (#12086)
  • utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

  • eslint-plugin: [unified-signatures] deduplicate types in report (#12656)
  • eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
  • eslint-plugin: [unified-signatures] report identical signatures (#12678)
  • eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
  • eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
  • eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
  • website: playground crashes on extends configs (#12608)
  • website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group with 5 updates
c66efd0 
Bumps the dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.70.0` | `10.72.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.2` |
| [eslint](https://github.com/eslint/eslint) | `10.9.0` | `10.9.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.68.0` |


Updates `@sentry/node` from 10.70.0 to 10.72.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.72.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.70.0...10.72.0)

Updates `express-rate-limit` from 8.6.2 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.6.2...v8.7.0)

Updates `zod` from 4.4.3 to 4.5.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.2)

Updates `eslint` from 10.9.0 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.9.0...v10.9.1)

Updates `typescript-eslint` from 8.67.0 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@sentry/node"
  dependency-version: 10.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: zod
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@grubersjoe
grubersjoe merged commit ba31007 into main Sep 2, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-43df445b1b branch September 2, 2026 19:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@grubersjoe grubersjoe

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@grubersjoe