From 769144f6c09e1e702e53c88f8efcd4c7634e3210 Mon Sep 17 00:00:00 2001
From: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
Date: Thu, 30 Jul 2026 10:01:26 +0200
Subject: [PATCH 1/5] feat(dataCollection)!: Align request data collection with
 v11 defaults

---
 packages/cloudflare/src/sdk.ts           |  7 +------
 packages/cloudflare/test/request.test.ts | 12 +++++-------
 packages/vercel-edge/src/sdk.ts          |  9 ++++-----
 packages/vercel-edge/test/sdk.test.ts    |  8 +++++++-
 4 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/packages/cloudflare/src/sdk.ts b/packages/cloudflare/src/sdk.ts
index ac85151846f0..23c4d393b0fc 100644
--- a/packages/cloudflare/src/sdk.ts
+++ b/packages/cloudflare/src/sdk.ts
@@ -41,11 +41,6 @@ function getRegisteredChannelIntegrations(): Integration[] {
 
 /** Get the default integrations for the Cloudflare SDK. */
 export function getDefaultIntegrations(options: CloudflareOptions): Integration[] {
-  // TODO(v11): Drop this transitional gating and let `requestDataIntegration` rely on the resolved
-  // `dataCollection` defaults directly. Until then, preserve the historical Cloudflare behavior of not
-  // attaching cookies unless the user explicitly opts in via `sendDefaultPii` or `dataCollection.cookies`.
-  // eslint-disable-next-line typescript/no-deprecated
-  const cookiesEnabled = options.sendDefaultPii || options.dataCollection?.cookies != null;
   return [
     // The Dedupe integration should not be used in workflows because we want to
     // capture all step failures, even if they are the same error.
@@ -58,7 +53,7 @@ export function getDefaultIntegrations(options: CloudflareOptions): Integration[
     linkedErrorsIntegration(),
     fetchIntegration(),
     httpServerIntegration(),
-    requestDataIntegration(cookiesEnabled ? undefined : { include: { cookies: false } }),
+    requestDataIntegration(),
     consoleIntegration(),
     // The orchestrion diagnostics-channel subscribers (mysql, pg, …). The
     // `@sentry/cloudflare/vite` plugin injects the channels at build time and,
diff --git a/packages/cloudflare/test/request.test.ts b/packages/cloudflare/test/request.test.ts
index a517c5b9ef39..5a68493204ce 100644
--- a/packages/cloudflare/test/request.test.ts
+++ b/packages/cloudflare/test/request.test.ts
@@ -241,9 +241,7 @@ describe('withSentry', () => {
       );
     });
 
-    // TODO(v11): Cookies should be attached (subject to denylist filtering) by default. Until then we keep the
-    // historical Cloudflare behavior of not attaching cookies unless the user explicitly opts in.
-    test('does not capture cookies by default', async () => {
+    test('captures cookies with denylist filtering by default', async () => {
       let sentryEvent: Event = {};
 
       await wrapRequestHandler(
@@ -264,7 +262,7 @@ describe('withSentry', () => {
         },
       );
 
-      expect(sentryEvent.request?.cookies).toBeUndefined();
+      expect(sentryEvent.request?.cookies).toEqual({ foo: 'bar' });
     });
 
     test('captures cookies when dataCollection.cookies is enabled', async () => {
@@ -292,14 +290,14 @@ describe('withSentry', () => {
       expect(sentryEvent.request?.cookies).toEqual({ foo: 'bar' });
     });
 
-    test('captures cookies when sendDefaultPii is enabled', async () => {
+    test('does not capture cookies when dataCollection.cookies is disabled', async () => {
       let sentryEvent: Event = {};
 
       await wrapRequestHandler(
         {
           options: {
             ...MOCK_OPTIONS,
-            sendDefaultPii: true,
+            dataCollection: { cookies: false },
             beforeSend(event) {
               sentryEvent = event;
               return null;
@@ -314,7 +312,7 @@ describe('withSentry', () => {
         },
       );
 
-      expect(sentryEvent.request?.cookies).toEqual({ foo: 'bar' });
+      expect(sentryEvent.request?.cookies).toBeUndefined();
     });
 
     test('does not capture request body for GET requests', async () => {
diff --git a/packages/vercel-edge/src/sdk.ts b/packages/vercel-edge/src/sdk.ts
index 903f3492648a..6346c55ea35a 100644
--- a/packages/vercel-edge/src/sdk.ts
+++ b/packages/vercel-edge/src/sdk.ts
@@ -1,5 +1,5 @@
 import { diag, DiagLogLevel, propagation, trace } from '@opentelemetry/api';
-import type { Client, Integration, Options } from '@sentry/core';
+import type { Client, Integration } from '@sentry/core';
 import {
   consoleIntegration,
   conversationIdIntegration,
@@ -35,9 +35,8 @@ declare const process: {
 
 const nodeStackParser = createStackParser(nodeStackLineParser());
 
-/** Get the default integrations for the browser SDK. */
-export function getDefaultIntegrations(_options: Options): Integration[] {
-  // todo(v11): remove options parameter
+/** Get the default integrations for the Vercel Edge SDK. */
+export function getDefaultIntegrations(): Integration[] {
   return [
     dedupeIntegration(),
     // TODO(v11): Replace with `eventFiltersIntegration` once we remove the deprecated `inboundFiltersIntegration`
@@ -60,7 +59,7 @@ export function init(options: VercelEdgeOptions = {}): Client {
   scope.update(options.initialScope);
 
   if (options.defaultIntegrations === undefined) {
-    options.defaultIntegrations = getDefaultIntegrations(options);
+    options.defaultIntegrations = getDefaultIntegrations();
   }
 
   if (options.dsn === undefined && process.env.SENTRY_DSN) {
diff --git a/packages/vercel-edge/test/sdk.test.ts b/packages/vercel-edge/test/sdk.test.ts
index c23848424290..c3f707d50e89 100644
--- a/packages/vercel-edge/test/sdk.test.ts
+++ b/packages/vercel-edge/test/sdk.test.ts
@@ -1,7 +1,13 @@
 import { describe, expect, it } from 'vitest';
-import { init, spanStreamingIntegration } from '../src';
+import { getDefaultIntegrations, init, spanStreamingIntegration } from '../src';
 import { type Integration } from '@sentry/core';
 
+describe('getDefaultIntegrations', () => {
+  it('includes request data collection by default', () => {
+    expect(getDefaultIntegrations().map(integration => integration.name)).toContain('RequestData');
+  });
+});
+
 describe('init', () => {
   it('adds spanStreamingIntegration by default', () => {
     const client = init({});

From 685373782a64808e9eff203a5c3b550a642b7e15 Mon Sep 17 00:00:00 2001
From: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
Date: Thu, 30 Jul 2026 10:47:39 +0200
Subject: [PATCH 2/5] feat(core)!: Gate incoming HTTP body capture on
 `dataCollection.httpBodies`

---
 packages/cloudflare/test/request.test.ts |  4 +--
 packages/vercel-edge/test/sdk.test.ts    | 34 +++++++++++++++++++++++-
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/packages/cloudflare/test/request.test.ts b/packages/cloudflare/test/request.test.ts
index 5a68493204ce..a06d5ee29171 100644
--- a/packages/cloudflare/test/request.test.ts
+++ b/packages/cloudflare/test/request.test.ts
@@ -253,7 +253,7 @@ describe('withSentry', () => {
               return null;
             },
           },
-          request: new Request('https://example.com', { headers: { cookie: 'foo=bar' } }),
+          request: new Request('https://example.com', { headers: { cookie: 'foo=bar; session=secret' } }),
           context: createMockExecutionContext(),
         },
         () => {
@@ -262,7 +262,7 @@ describe('withSentry', () => {
         },
       );
 
-      expect(sentryEvent.request?.cookies).toEqual({ foo: 'bar' });
+      expect(sentryEvent.request?.cookies).toEqual({ foo: 'bar', session: '[Filtered]' });
     });
 
     test('captures cookies when dataCollection.cookies is enabled', async () => {
diff --git a/packages/vercel-edge/test/sdk.test.ts b/packages/vercel-edge/test/sdk.test.ts
index c3f707d50e89..b5e4522d8b73 100644
--- a/packages/vercel-edge/test/sdk.test.ts
+++ b/packages/vercel-edge/test/sdk.test.ts
@@ -1,11 +1,43 @@
 import { describe, expect, it } from 'vitest';
 import { getDefaultIntegrations, init, spanStreamingIntegration } from '../src';
-import { type Integration } from '@sentry/core';
+import { type Event, type Integration } from '@sentry/core';
 
 describe('getDefaultIntegrations', () => {
   it('includes request data collection by default', () => {
     expect(getDefaultIntegrations().map(integration => integration.name)).toContain('RequestData');
   });
+
+  it('collects and filters request cookies by default', () => {
+    const client = init({ skipOpenTelemetrySetup: true });
+    const requestDataIntegration = getDefaultIntegrations().find(integration => integration.name === 'RequestData');
+    const event: Event = {
+      sdkProcessingMetadata: {
+        normalizedRequest: { headers: { cookie: 'theme=dark; session=secret' } },
+      },
+    };
+
+    requestDataIntegration?.processEvent?.(event, {}, client);
+
+    expect(requestDataIntegration).toBeDefined();
+    expect(event.request?.cookies).toEqual({ theme: 'dark', session: '[Filtered]' });
+    expect(event.request?.headers?.cookie).toBe('[Filtered]');
+  });
+
+  it('does not collect request cookies when dataCollection.cookies is disabled', () => {
+    const client = init({ dataCollection: { cookies: false }, skipOpenTelemetrySetup: true });
+    const requestDataIntegration = getDefaultIntegrations().find(integration => integration.name === 'RequestData');
+    const event: Event = {
+      sdkProcessingMetadata: {
+        normalizedRequest: { headers: { cookie: 'theme=dark' } },
+      },
+    };
+
+    requestDataIntegration?.processEvent?.(event, {}, client);
+
+    expect(requestDataIntegration).toBeDefined();
+    expect(event.request?.cookies).toBeUndefined();
+    expect(event.request?.headers).toEqual({});
+  });
 });
 
 describe('init', () => {

From 071bc44dd734be86278447bf6d7240dbf593e184 Mon Sep 17 00:00:00 2001
From: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
Date: Thu, 30 Jul 2026 12:15:30 +0200
Subject: [PATCH 3/5] remove options

---
 packages/nextjs/src/edge/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/nextjs/src/edge/index.ts b/packages/nextjs/src/edge/index.ts
index edc095dd0f2b..bdb9b111f29f 100644
--- a/packages/nextjs/src/edge/index.ts
+++ b/packages/nextjs/src/edge/index.ts
@@ -63,7 +63,7 @@ export function init(options: VercelEdgeOptions = {}): void {
     );
   }
 
-  const customDefaultIntegrations = getDefaultIntegrations(options);
+  const customDefaultIntegrations = getDefaultIntegrations();
 
   // This value is injected at build time, based on the output directory specified in the build config. Though a default
   // is set there, we set it here as well, just in case something has gone wrong with the injection.

From fedf9c7c706811c2ba239e67c8c1744fbcfe9e61 Mon Sep 17 00:00:00 2001
From: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
Date: Fri, 31 Jul 2026 12:20:12 +0200
Subject: [PATCH 4/5] fix tests

---
 .../cloudflare-integration-tests/suites/basic/test.ts         | 1 +
 .../suites/double-instrumentation/test.ts                     | 1 +
 .../cloudflare-integration-tests/suites/hono-sdk/test.ts      | 1 +
 .../suites/integrations/http-server/test.ts                   | 4 ++++
 .../suites/tracing/dsc-url-source/test.ts                     | 1 +
 .../suites/tracing/headers/test.ts                            | 1 +
 .../test-applications/cloudflare-agent/tests/callable.test.ts | 1 +
 7 files changed, 10 insertions(+)

diff --git a/dev-packages/cloudflare-integration-tests/suites/basic/test.ts b/dev-packages/cloudflare-integration-tests/suites/basic/test.ts
index 1f6480f4cab4..efb0f4c35331 100644
--- a/dev-packages/cloudflare-integration-tests/suites/basic/test.ts
+++ b/dev-packages/cloudflare-integration-tests/suites/basic/test.ts
@@ -21,6 +21,7 @@ it('Basic error in fetch handler', async ({ signal }) => {
             ],
           },
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'GET',
             url: expect.any(String),
diff --git a/dev-packages/cloudflare-integration-tests/suites/double-instrumentation/test.ts b/dev-packages/cloudflare-integration-tests/suites/double-instrumentation/test.ts
index ab0b2155349b..89939f53c64c 100644
--- a/dev-packages/cloudflare-integration-tests/suites/double-instrumentation/test.ts
+++ b/dev-packages/cloudflare-integration-tests/suites/double-instrumentation/test.ts
@@ -21,6 +21,7 @@ it('Only sends one error event when withSentry is called twice', async ({ signal
             ],
           },
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'GET',
             url: expect.any(String),
diff --git a/dev-packages/cloudflare-integration-tests/suites/hono-sdk/test.ts b/dev-packages/cloudflare-integration-tests/suites/hono-sdk/test.ts
index bbaa75aae4e8..b2ee4c937032 100644
--- a/dev-packages/cloudflare-integration-tests/suites/hono-sdk/test.ts
+++ b/dev-packages/cloudflare-integration-tests/suites/hono-sdk/test.ts
@@ -22,6 +22,7 @@ it('Hono app captures parametrized errors (Hono SDK)', async ({ signal }) => {
             ],
           },
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'GET',
             url: expect.stringContaining('/error/param-123'),
diff --git a/dev-packages/cloudflare-integration-tests/suites/integrations/http-server/test.ts b/dev-packages/cloudflare-integration-tests/suites/integrations/http-server/test.ts
index f36849462a42..68649db65b63 100644
--- a/dev-packages/cloudflare-integration-tests/suites/integrations/http-server/test.ts
+++ b/dev-packages/cloudflare-integration-tests/suites/integrations/http-server/test.ts
@@ -10,6 +10,7 @@ it('Captures JSON request body', async ({ signal }) => {
           level: 'info',
           message: 'POST JSON request',
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'POST',
             url: expect.stringContaining('/post-json'),
@@ -38,6 +39,7 @@ it('Captures form-urlencoded request body', async ({ signal }) => {
           level: 'info',
           message: 'POST form request',
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'POST',
             url: expect.stringContaining('/post-form'),
@@ -66,6 +68,7 @@ it('Captures plain text request body', async ({ signal }) => {
           level: 'info',
           message: 'POST text request',
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'POST',
             url: expect.stringContaining('/post-text'),
@@ -94,6 +97,7 @@ it('Does not capture body for POST without content', async ({ signal }) => {
           level: 'info',
           message: 'POST no body request',
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'POST',
             url: expect.stringContaining('/post-no-body'),
diff --git a/dev-packages/cloudflare-integration-tests/suites/tracing/dsc-url-source/test.ts b/dev-packages/cloudflare-integration-tests/suites/tracing/dsc-url-source/test.ts
index 14ea900e179a..9118790e0758 100644
--- a/dev-packages/cloudflare-integration-tests/suites/tracing/dsc-url-source/test.ts
+++ b/dev-packages/cloudflare-integration-tests/suites/tracing/dsc-url-source/test.ts
@@ -23,6 +23,7 @@ it('omits the span name from the DSC for url-source spans when tracing is enable
             ],
           },
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'GET',
             url: expect.any(String),
diff --git a/dev-packages/cloudflare-integration-tests/suites/tracing/headers/test.ts b/dev-packages/cloudflare-integration-tests/suites/tracing/headers/test.ts
index a20ec16a354f..e73e04583ffb 100644
--- a/dev-packages/cloudflare-integration-tests/suites/tracing/headers/test.ts
+++ b/dev-packages/cloudflare-integration-tests/suites/tracing/headers/test.ts
@@ -46,6 +46,7 @@ it('Tracing headers', async ({ signal }) => {
             },
           ],
           request: {
+            cookies: {},
             headers: expect.any(Object),
             method: 'GET',
             url: expect.any(String),
diff --git a/dev-packages/e2e-tests/test-applications/cloudflare-agent/tests/callable.test.ts b/dev-packages/e2e-tests/test-applications/cloudflare-agent/tests/callable.test.ts
index b41347148fb6..321f4863dcc8 100644
--- a/dev-packages/e2e-tests/test-applications/cloudflare-agent/tests/callable.test.ts
+++ b/dev-packages/e2e-tests/test-applications/cloudflare-agent/tests/callable.test.ts
@@ -48,6 +48,7 @@ test('@callable() methods work correctly with Sentry instrumentAgentWithSentry',
     transaction: 'GET /agents/my-agent/user-123',
     type: 'transaction',
     request: {
+      cookies: {},
       headers: expect.any(Object),
       method: 'GET',
       url: expect.stringContaining('/agents/my-agent/user-123'),

From fb49cda1cc1d1967e50d3d55ebf4e9a7fb1a385c Mon Sep 17 00:00:00 2001
From: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
Date: Fri, 31 Jul 2026 16:04:40 +0200
Subject: [PATCH 5/5] fix unit test

---
 packages/cloudflare/test/request.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/cloudflare/test/request.test.ts b/packages/cloudflare/test/request.test.ts
index 742da327a821..242d40cdda6b 100644
--- a/packages/cloudflare/test/request.test.ts
+++ b/packages/cloudflare/test/request.test.ts
@@ -290,7 +290,7 @@ describe('withSentry', () => {
         },
       );
 
-      expect(sentryEvent.sdkProcessingMetadata?.normalizedRequest?.data).toEqual({ foo: 'bar', session: '[Filtered]' });
+      expect(sentryEvent.request?.cookies).toEqual({ foo: 'bar', session: '[Filtered]' });
     });
 
     test('explicit maxRequestBodySize overrides dataCollection.httpBodies', async () => {