Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@sentry/astro
Advanced tools
This SDK is in Beta and not yet fully stable. If you have feedback or encounter any bugs, feel free to open an issue.
This package is a wrapper around @sentry/node
for the server and @sentry/browser
for the client side.
Install the Sentry Astro SDK with the astro
CLI:
npx astro add @sentry/astro
Add your DSN and source maps upload configuration:
import { defineConfig } from 'astro/config';
import sentry from '@sentry/astro';
export default defineConfig({
integrations: [
sentry({
dsn: '__DSN__',
sourceMapsUploadOptions: {
project: 'your-sentry-project-slug',
authToken: process.env.SENTRY_AUTH_TOKEN,
},
}),
],
});
Follow this guide to create an auth token and add it to your environment variables:
SENTRY_AUTH_TOKEN="your-token"
For Astro apps configured for (hybrid) Server Side Rendering (SSR), the Sentry integration will automatically add middleware to your server to instrument incoming requests if you're using Astro 3.5.2 or newer.
If you're using Astro <3.5.2, complete the setup by adding the Sentry middleware to your src/middleware.js
file:
// src/middleware.js
import { sequence } from 'astro:middleware';
import * as Sentry from '@sentry/astro';
export const onRequest = sequence(
Sentry.handleRequest(),
// Add your other handlers after Sentry.handleRequest()
);
The Sentry middleware enhances the data collected by Sentry on the server side by:
You can opt out of using the automatic sentry server instrumentation in your astro.config.mjs
file:
import { defineConfig } from 'astro/config';
import sentry from '@sentry/astro';
export default defineConfig({
integrations: [
sentry({
dsn: '__DSN__',
autoInstrumentation: {
requestHandler: false,
},
}),
],
});
Check out our docs for configuring your SDK setup:
8.41.0
meta(nuxt): Require minimum Nuxt v3.7.0 (#14473)
We formalized that the Nuxt SDK is at minimum compatible with Nuxt version 3.7.0 and above.
Additionally, the SDK requires the implicit nitropack
dependency to satisfy version ^2.10.0
and ofetch
to satisfy ^1.4.0
.
It is recommended to check your lock-files and manually upgrade these dependencies if they don't match the version ranges.
We are deprecating a few APIs which will be removed in the next major.
The following deprecations will potentially affect you:
feat(core): Update & deprecate undefined
option handling (#14450)
In the next major version we will change how passing undefined
to tracesSampleRate
/ tracesSampler
/ enableTracing
will behave.
Currently, doing the following:
Sentry.init({
tracesSampleRate: undefined,
});
Will result in tracing being enabled (although no spans will be generated) because the tracesSampleRate
key is present in the options object.
In the next major version, this behavior will be changed so that passing undefined
(or rather having a tracesSampleRate
key) will result in tracing being disabled, the same as not passing the option at all.
If you are currently relying on undefined
being passed, and and thus have tracing enabled, it is recommended to update your config to set e.g. tracesSampleRate: 0
instead, which will also enable tracing in v9.
The same applies to tracesSampler
and enableTracing
.
feat(core): Log warnings when returning null
in beforeSendSpan
(#14433)
Currently, the beforeSendSpan
option in Sentry.init()
allows you to drop individual spans from a trace by returning null
from the hook.
Since this API lends itself to creating "gaps" inside traces, we decided to change how this API will work in the next major version.
With the next major version the beforeSendSpan
API can only be used to mutate spans, but no longer to drop them.
With this release the SDK will warn you if you are using this API to drop spans.
Instead, it is recommended to configure instrumentation (i.e. integrations) directly to control what spans are created.
Additionally, with the next major version, root spans will also be passed to beforeSendSpan
.
feat(utils): Deprecate @sentry/utils
(#14431)
With the next major version the @sentry/utils
package will be merged into the @sentry/core
package.
It is therefore no longer recommended to use the @sentry/utils
package.
feat(vue): Deprecate configuring Vue tracing options anywhere else other than through the vueIntegration
's tracingOptions
option (#14385)
Currently it is possible to configure tracing options in various places in the Sentry Vue SDK:
Sentry.init()
tracingOptions
in Sentry.init()
vueIntegration()
optionstracingOptions
in the vueIntegration()
optionsBecause this is a bit messy and confusing to document, the only recommended way to configure tracing options going forward is through the tracingOptions
in the vueIntegration()
.
The other means of configuration will be removed in the next major version of the SDK.
feat: Deprecate registerEsmLoaderHooks.include
and registerEsmLoaderHooks.exclude
(#14486)
Currently it is possible to define registerEsmLoaderHooks.include
and registerEsmLoaderHooks.exclude
options in Sentry.init()
to only apply ESM loader hooks to a subset of modules.
This API served as an escape hatch in case certain modules are incompatible with ESM loader hooks.
Since this API was introduced, a way was found to only wrap modules that there exists instrumentation for (meaning a vetted list).
To only wrap modules that have instrumentation, it is recommended to instead set registerEsmLoaderHooks.onlyIncludeInstrumentedModules
to true
.
Note that onlyIncludeInstrumentedModules: true
will become the default behavior in the next major version and the registerEsmLoaderHooks
will no longer accept fine-grained options.
The following deprecations will most likely not affect you unless you are building an SDK yourself:
arrayify
(#14405)flatten
(#14454)urlEncode
(#14406)validSeverityLevels
(#14407)getNumberOfUrlSegments
(#14458)memoBuilder
, BAGGAGE_HEADER_NAME
, and makeFifoCache
(#14434)addRequestDataToEvent
and extractRequestData
(#14430)sentry-trace
, baggage
and DSC handling (#14364)openTelemetryInstrumentations
option (#14484)NEXT_REDIRECT
from browser (#14440)Work in this release was contributed by @NEKOYASAN and @fmorett. Thank you for your contributions!
FAQs
Official Sentry SDK for Astro
The npm package @sentry/astro receives a total of 7,512 weekly downloads. As such, @sentry/astro popularity was classified as popular.
We found that @sentry/astro demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.