Merge remote-tracking branch 'origin/develop' into feat/migrate-ai-attributes-to-conventions

# Conflicts:
#	packages/core/src/shared-exports.ts

Author: nicohrubec

.agents/skills/track-framework-updates/scripts/check_sources.py

@@ -47,7 +47,6 @@
     "@sentry/core",
     "@sentry/types",
     "@sentry/browser",
-    "@sentry/node-core",
     "@sentry/node-native",
     "@sentry/opentelemetry",
     "@sentry/profiling-node",

.craft.yml

@@ -13,9 +13,6 @@ targets:
   - name: npm
     id: '@sentry/types'
     includeNames: /^sentry-types-\d.*\.tgz$/
-  - name: npm
-    id: '@sentry/node-core'
-    includeNames: /^sentry-node-core-\d.*\.tgz$/
   - name: npm
     id: '@sentry/server-utils'
     includeNames: /^sentry-server-utils-\d.*\.tgz$/
@@ -226,8 +223,6 @@ targets:
         onlyIfPresent: /^sentry-nuxt-\d.*\.tgz$/
       'npm:@sentry/node':
         onlyIfPresent: /^sentry-node-\d.*\.tgz$/
-      'npm:@sentry/node-core':
-        onlyIfPresent: /^sentry-node-core-\d.*\.tgz$/
       'npm:@sentry/react':
         onlyIfPresent: /^sentry-react-\d.*\.tgz$/
       'npm:@sentry/react-router':

.cursor/BUGBOT.md

@@ -68,7 +68,7 @@ Unless explicitly noted (e.g. in the `Testing Conventions` section), only flag t
   - Race conditions when waiting on multiple requests. Ensure that waiting checks are unique enough and don't depend on a hard order when there's a chance that telemetry can be sent in arbitrary order.
   - Timeouts or sleeps in tests. Instead suggest concrete events or other signals to wait on.
 - Flag usage of `getFirstEnvelope*`, `getMultipleEnvelope*` or related test helpers in E2E tests. These are NOT reliable anymore. Instead suggest helpers like `waitForTransaction`, `waitForError`, `waitForSpans`, etc.
-- Flag any new or modified `docker-compose.yml` under `dev-packages/node-integration-tests/suites/` or `dev-packages/node-core-integration-tests/suites/` where a service does not define a `healthcheck:`. The runner uses `docker compose up --wait` and relies on healthchecks to know when services are actually ready; without one the test will race the service's startup.
+- Flag any new or modified `docker-compose.yml` under `dev-packages/node-integration-tests/suites/` where a service does not define a `healthcheck:`. The runner uses `docker compose up --wait` and relies on healthchecks to know when services are actually ready; without one the test will race the service's startup.
 
 ## Platform-safe code
 

.github/CODEOWNERS

@@ -10,7 +10,6 @@
 # Node/server runtimes and related packages
 # TEMP: whole JS SDK team reviews orchestrion work; revert to team-javascript-sdks-server after
 /packages/node/                     @getsentry/team-javascript-sdks
-/packages/node-core/                @getsentry/team-javascript-sdks
 /packages/server-utils/             @getsentry/team-javascript-sdks
 /packages/node-native/              @getsentry/team-javascript-sdks-server
 /packages/profiling-node/           @getsentry/team-javascript-sdks-server
@@ -22,7 +21,6 @@
 /packages/google-cloud-serverless/  @getsentry/team-javascript-sdks-server
 /packages/vercel-edge/              @getsentry/team-javascript-sdks-server
 /dev-packages/node-integration-tests/ @getsentry/team-javascript-sdks-server
-/dev-packages/node-core-integration-tests/ @getsentry/team-javascript-sdks-server
 /dev-packages/cloudflare-integration-tests/ @getsentry/team-javascript-sdks-server
 /dev-packages/bun-integration-tests/ @getsentry/team-javascript-sdks-server
 /dev-packages/deno-integration-tests/ @getsentry/team-javascript-sdks-server

.github/workflows/build.yml

@@ -4,6 +4,7 @@ on:
     branches:
       - develop
       - master
+      - v10
       - v9
       - v8
       - release/**
@@ -157,9 +158,6 @@ jobs:
       changed_node_integration:
         ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
         '@sentry-internal/node-integration-tests') }}
-      changed_node_core_integration:
-        ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
-        '@sentry-internal/node-core-integration-tests') }}
       changed_node:
         ${{ needs.job_get_metadata.outputs.changed_ci == 'true' || contains(steps.checkForAffected.outputs.affected,
         '@sentry/node') }}
@@ -849,47 +847,6 @@ jobs:
         env:
           INJECT_ORCHESTRION: ${{ matrix.use_orchestrion }}
 
-  job_node_core_integration_tests:
-    name:
-      Node (${{ matrix.node }})${{ (matrix.typescript && format(' (TS {0})', matrix.typescript)) || '' }} Node-Core
-      Integration Tests
-    needs: [job_get_metadata, job_build]
-    if: needs.job_build.outputs.changed_node_core_integration == 'true' || github.event_name != 'pull_request'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [20.19, 22, 24, 26]
-        typescript:
-          - false
-        include:
-          # Only check typescript for latest version (to streamline CI)
-          - node: 24
-            typescript: '5.0'
-    steps:
-      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ env.HEAD_COMMIT }}
-      - name: Set up Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ matrix.node }}
-      - name: Restore caches
-        uses: ./.github/actions/restore-cache
-        with:
-          dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
-
-      - name: Overwrite typescript version
-        if: matrix.typescript == '5.0'
-        run: node ./scripts/use-ts-5_0.js
-        working-directory: dev-packages/node-core-integration-tests
-
-      - name: Run integration tests
-        working-directory: dev-packages/node-core-integration-tests
-        run: yarn test
-
   job_cloudflare_integration_tests:
     name: Cloudflare Integration Tests
     needs: [job_get_metadata, job_build]
@@ -1299,7 +1256,6 @@ jobs:
         job_deno_unit_tests,
         job_node_unit_tests,
         job_node_integration_tests,
-        job_node_core_integration_tests,
         job_cloudflare_integration_tests,
         job_bundler_plugin_integration_tests,
         job_bun_integration_tests,

.github/workflows/enforce-license-compliance.yml

@@ -5,13 +5,15 @@ on:
     branches:
       - develop
       - master
+      - v10
       - v9
       - v8
       - release/**
   pull_request:
     branches:
       - develop
       - master
+      - v10
       - v9
       - v8
 

.size-limit.js

@@ -374,16 +374,6 @@ module.exports = [
     limit: '71 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
-  // Node-Core SDK (ESM)
-  {
-    name: '@sentry/node-core',
-    path: 'packages/node-core/build/esm/index.js',
-    import: createImport('init'),
-    ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
-    gzip: true,
-    limit: '69 KB',
-    disablePlugins: ['@size-limit/esbuild'],
-  },
   // Node SDK (ESM)
   {
     name: '@sentry/node',
@@ -411,15 +401,6 @@ module.exports = [
     limit: '76 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
-  {
-    name: '@sentry/node/light',
-    path: 'packages/node-core/build/esm/light/index.js',
-    import: createImport('init'),
-    ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
-    gzip: true,
-    limit: '57 KB',
-    disablePlugins: ['@size-limit/esbuild'],
-  },
   {
     name: '@sentry/node - without tracing',
     path: 'packages/node/build/esm/index.js',

AGENTS.md

@@ -86,12 +86,11 @@ Uses **Git Flow** (see `docs/gitflow.md`).
 - `packages/core/` — Base SDK: interfaces, types, core functionality
 - `packages/types/` — Shared types (**deprecated, never modify – instead find types in packages/core**)
 - `packages/browser-utils/` — Browser utilities and instrumentation
-- `packages/node-core/` — Node core logic (excludes OTel instrumentation)
 
 ### Platform SDKs
 
 - `packages/browser/` — Browser SDK + CDN bundles
-- `packages/node/` — Node.js SDK (OTel instrumentation on top of node-core)
+- `packages/node/` — Node.js SDK (client, transports, non-OTel integrations, and OTel instrumentation)
 - `packages/bun/`, `packages/deno/`, `packages/cloudflare/`
 
 ### Framework Integrations

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
-Work in this release was contributed by @psh4607, @trinitiwowka, and @nehaprasad-dev. Thank you for your contributions!
+Work in this release was contributed by @psh4607, @trinitiwowka, @nehaprasad-dev, and @JealousGx. Thank you for your contributions!
 
 ## 10.67.0
 

MIGRATION.md

@@ -97,6 +97,24 @@ Affected SDKs: `@sentry/node` and all dependents.
 
 The new channel-based instrumentations (using `orchestrion` instead of `import-in-the-middle`) are now the default. They were available opt-in in v10. This unlocks instrumenting at run and build time, which enables instrumentation at deployment targets like Vercel and Netlify, as well as using instrumentations on non-Node runtimes like Cloudflare, Bun and Deno. For most users this requires no changes.
 
+### Initializing via `--require` is no longer supported
+
+Affected SDKs: `@sentry/node` and all dependents.
+
+Node re-runs `--require` preloads on the internal module loader thread it spawns for `Module.register()` — which the SDK triggers itself when it installs its instrumentation hooks. A `--require`d instrument file therefore ran `Sentry.init()` a second time, on a thread that never executes any of your code. The SDK now skips initialization on that thread and warns when it detects that it was loaded through `--require`.
+
+Use [`--import`](https://nodejs.org/api/cli.html#--importmodule) instead. It is not re-run on the loader thread, and it works for CommonJS apps too — the instrument file's extension (`.cjs`, or `.js` in a package without `"type": "module"`) is what decides that it loads as CommonJS:
+
+```bash
+# Before
+node --require ./instrument.js app.js
+
+# After
+node --import ./instrument.js app.js
+```
+
+The same applies to the no-code entry points, e.g. `node --import=@sentry/node/init app.js` and `node --import @sentry/node/preload app.js`.
+
 ### Span streaming is now the default
 
 Affected SDKs: All SDKs.
@@ -315,6 +333,10 @@ Sentry.init({
 });
 ```
 
+### `@sentry/browser`
+
+- The experimental `_experiments.enableStandaloneClsSpans` and `_experiments.enableStandaloneLcpSpans` options were removed from both `browserTracingIntegration` and `webVitalsIntegration`. CLS and LCP are no longer configurable: they are recorded as measurements on the pageload span, unless span streaming is enabled (`traceLifecycle: 'stream'`), in which case they are sent as dedicated spans.
+
 ### `@sentry/node` / Server-side SDKs
 
 - `SentryContextManager` is no longer exported. It is no longer needed now that Sentry does not set up OpenTelemetry by default.
@@ -398,7 +420,10 @@ Sentry.init({
 
 ### `@sentry/react-router`
 
-- The React Router server request wrappers were removed.
+- The deprecated server wrappers `wrapServerLoader` and `wrapServerAction` were removed. Loaders and
+  actions are instrumented automatically via the instrumentation API - export
+  `instrumentations = [Sentry.createSentryServerInstrumentation()]` from your `entry.server.tsx`
+  instead of wrapping them individually.
 
 ### `@sentry/profiling-node`