v3.3.1

Highlights

• Apps local development (Vite): backend functions running locally can reach the network, writes outside the project and subprocesses are guarded, and edited backend code runs on the next call without a restart.
• Apps backend bundles: each backend function is now tree-shaken and minified, so it no longer ships code only its sibling functions use (#538, #540, #554). Builds log each bundle's size.
• Apps tags: the apps plugin writes the app's tags to manifest.json, so product surfaces can find the apps meant for them (#532).
• Live Debugger: a fileExtensions option stops broad include globs from instrumenting CSS and other non-JS files (#506), and overlapping async calls are now paired with the right exit hook (#515).
• Source code metadata: a gitRepositoryUrl option sets the repository identity explicitly, for CI checkouts cloned through a mirror (#518).
• RUM: source code context registration captures only one stack frame, avoiding expensive source-position collection during bundle evaluation (#553).
• Security: fixes advisories in picomatch, simple-git and rollup, and rollup is no longer a runtime dependency.
• process.env scoping (#504, #510) and local-file Custom Credentials (#512) were added and then reverted in #523, so neither ships. #523 keeps two changes from that work: backend builds no longer inline VITE_* environment values, and the local-execution network guard is hardened.

What's Changed

• Update CLAUDE.md intro and remove the confirmation section by @oliverli in #514
• fix(live-debugger): pass an invocation handle from entry to exit hooks by @watson in #515
• Add safe Live Debugger file extension filtering by @watson in #506
• Add Live Debugger consumer build canary by @watson in #508
• Improve Live Debugger benchmark comment guidance by @watson in #507
• Fix flaky apps dev-server timeout tests by @ksun154 in #517
• Refactor CODEOWNERS to simplify ownership entries by @yoannmoinet in #516
• Add a Git repository URL override for source metadata by @watson in #518
• Shard End to End tests across two jobs by @telecatser in #526
• [APPS-2792] Fix: stop test runs leaking temp directories by @tyffical in #535
• [APPS-2792] Fix: stop logging full $.Actions responses by @tyffical in #531
• [APPS-2792] Fix: only transform backend files on Vite versions without hook filters by @tyffical in #537
• [APPS-2792] Clean up: revert process.env scoping and the Custom Credentials local-file mechanism by @tyffical in #523
• [APPS] Tree-shake backend function bundles by @ksun154 in #538
• [APPS-2943] Fix: scrub Datadog env vars before test files are collected by @tyffical in #541
• [APPS] Minify backend bundles by @ksun154 in #540
• [APPS-2792] Fix: run edited backend code on the next local execution by @tyffical in #530
• [APPS-2792] Harden network-guard, drop local network blocking by @tyffical in #524
• [APPS-2946] Fix: protect nock's interceptors and stop re-activating nock between test files by @tyffical in #545
• [APPS] Fix backend minification on Vite 8 by @ksun154 in #554
• [apps] Write app tags (authored + used input surfaces) to manifest.json by @Scott-Meyer in #532
• fix(rum): limit source code context registration to one stack frame by @amortemousque in #553

Security

• [APPS-2792] Fix: bump picomatch to 4.0.7 (GHSA-c2c7-rcm5-vvqj) by @tyffical in #547
• [APPS-2792] Fix: stop shipping rollup to customers; bump dev rollup and vite by @tyffical in #549
• [APPS-2792] Fix: bump simple-git to 4.0.2 (critical advisories) by @tyffical in #555

New Contributors

• @ksun154 made their first contribution in #517
• @telecatser made their first contribution in #526

Full Changelog: v3.3.0...v3.3.1