feat(ember)!: Update to v2 addon format - #23252
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| const globalsPerformanceConfig = { | ||
| disableRunloopPerformance: options.disableRunloopPerformance ?? false, | ||
| minimumRunloopQueueDuration: options.minimumRunloopQueueDuration, | ||
| minimumRunloopQueueDuration: options.minimumRunloopQueueDuration ?? 0, |
There was a problem hiding this comment.
Idle timeout default dropped
Medium Severity
The Ember integration no longer sets idleTimeout to 5000. It now inherits the browser default of 1000ms. Quiet stretches during a transition (for example a slow model hook without child spans) can finish the navigation/pageload span early, truncating Ember route timing that previously waited up to 5 seconds.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 1f20412. Configure here.
4b990e8 to
4dcd6de
Compare
size-limit report 📦
|
4dcd6de to
6884073
Compare
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
|
|
||
| "@babel/plugin-transform-runtime@7.18.10", "@babel/plugin-transform-runtime@^7.13.9": | ||
| "@babel/plugin-transform-runtime@7.18.10": |
There was a problem hiding this comment.
Critical severity vulnerability may affect your project—review required:
Line 2594 lists a dependency (@babel/plugin-transform-runtime) with a known Critical severity vulnerability.
ℹ️ Why this matters
Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.
To resolve this comment:
Check if you use Babel to compile untrusted JavaScript.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
8a593fd to
01de976
Compare
| "@embroider/addon-dev": "^8.3.0", | ||
| "@embroider/compat": "^4.1.17", | ||
| "@embroider/core": "^4.4.7", | ||
| "@embroider/macros": "^1.20.2", |
There was a problem hiding this comment.
This is e.g. still used in browserTracingIntegration, why was this moved to devDep?
| "lint:fix": "OXLINT_TSGOLINT_DANGEROUSLY_SUPPRESS_PROGRAM_DIAGNOSTICS=true oxlint . --fix --type-aware", | ||
| "lint": "OXLINT_TSGOLINT_DANGEROUSLY_SUPPRESS_PROGRAM_DIAGNOSTICS=true oxlint . --type-aware", |
There was a problem hiding this comment.
Why do we do OXLINT_TSGOLINT_DANGEROUSLY_SUPPRESS_PROGRAM_DIAGNOSTICS?
There was a problem hiding this comment.
good catch, I think we had this when this was written originally but since removed it 👍
|
|
||
| ### FastBoot / SSR | ||
|
|
||
| The performance instrumentation automatically detects FastBoot and disables client-side instrumentation during server rendering. No changes needed. |
There was a problem hiding this comment.
q: How is this done? The packages/ember/addon/instance-initializers/sentry-performance.ts was removed and it looks like this was responsible for this part?
There was a problem hiding this comment.
jup, true, I re-added the check to skip this in instrumentAppInstancePerformance
| import { instrumentEmberAppInstanceForPerformance } from './instrumentEmberAppInstanceForPerformance'; | ||
| import { instrumentGlobalsForPerformance } from './instrumentEmberGlobals'; | ||
| import { instrumentEmberAppInstanceForPerformance } from './instrumentEmberAppInstanceForPerformance.ts'; | ||
| import { instrumentGlobalsForPerformance } from './instrumentEmberGlobals.ts'; |
There was a problem hiding this comment.
Macros still imported at runtime
High Severity
browserTracingIntegration still imports isTesting / macroCondition from @embroider/macros, but that package is only a devDependency and the publish Babel config does not strip macros. That leaves a runtime import in published output, which contradicts the migration goal and can break consumers that do not already depend on @embroider/macros (for example classic Ember apps).
Additional Locations (2)
Reviewed by Cursor Bugbot for commit d66cb46. Configure here.
| // TODO(v11): make this required | ||
| appInstance?: ApplicationInstance; |
There was a problem hiding this comment.
Should this change be added in the migration guide?
There was a problem hiding this comment.
this generally needs an entry in migration guide, let me add one!
There was a problem hiding this comment.
I see most of the test files are deleted: are those cases covered in E2E or somewhere else now?
There was a problem hiding this comment.
yes this test app was moved to e2e app instead of running inside of the package itself.
daf2510 to
cdc0622
Compare
| const { fromRoute, toRoute } = getTransitionInformation(transition, routerService); | ||
|
|
||
| // Store this here to be used, even if the active span has ended | ||
| getCurrentScope().setTransactionName(`route:${toRoute}`); |
There was a problem hiding this comment.
Avoidable getCurrentScope usage
Low Severity
This is more of an "is this necessary" check than a hard rule violation: getCurrentScope() is used here to set the transaction name. In multi-client setups that can touch the wrong scope or create an unintended current scope. A client/scope reference already available in this instrumentation path would be safer.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit cdc0622. Configure here.
| options?: Partial<Parameters<typeof browserTracingIntegration>[0]>, | ||
| ): void { | ||
| // Disable in FastBoot — we only want to run Sentry client-side | ||
| const fastboot = appInstance.lookup('service:fastboot') as unknown as { isFastBoot: boolean } | undefined; |
There was a problem hiding this comment.
Uncommented double cast in source
Low Severity
This introduces an as unknown as cast for the FastBoot service lookup without a comment explaining why a safer type is not possible. The review guidelines require such casts in SDK source to document why narrower typing cannot be used.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit cdc0622. Configure here.
Squashed from PR #19229 (getsentry/sentry-javascript). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cdc0622 to
b4f2a29
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 5 total unresolved issues (including 4 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b4f2a29. Configure here.
| [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: routeInfo ? 'route' : 'url', | ||
| [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: 'auto.pageload.ember', | ||
| ...(url ? _getRouteUrlAttributes(client, url, routeInfo?.params) : {}), | ||
| url, |
There was a problem hiding this comment.
Unfiltered raw URL attribute
Medium Severity
url.full is correctly wrapped with filterCollectedUrl(), but the adjacent raw url attribute is still set from the unfiltered location string. That bypasses dataCollection.urlQueryParams for a deprecated alias sitting next to the filtered attribute, which this review rule calls out.
Additional Locations (1)
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit b4f2a29. Configure here.
chargome
left a comment
chargome
left a comment
There was a problem hiding this comment.
Just the dataCollection change otherwise LGTM
3 participants
Rebased continuation of #19229 (original author @aklkv) onto current
develop, with merge conflicts resolved and the failing tests fixed.Migrates
@sentry/emberfrom the legacy v1 addon format to the Ember v2 addon format, so the package works with both classic Ember builds and Embroider-optimized builds and no longer depends on@embroider/macrosat runtime. See #19229 for the full description of the migration.Why a new branch
The original PR was ~1900 commits behind
developand conflicting. Rather than resolve the same conflicts twice across its two commits, I squashed them into one and rebased against the final state once.The subtle part: the migration renamed
packages/ember/addon/→src/. Git therefore saw develop's later behavioral changes to those files as edits to deleted files and did not surface them as conflicts. Several develop-side changes had to be ported into the newsrc/files by hand:functionandui.taskspan ops for route hooks and runloop #22669, feat(angular,ember,sveltekit)!: Userouterspan op for frontend routers #23086) — route hooks now emitop: 'function'with acode.function.nameattribute; the runloop usesui.task; the transition span usesrouter.instrumentRoutePerformance.tsstill carried the oldui.ember.route.*ops and had to be updated.url.fullattribute to core fetch instrumentation #22415) —url.path/url.full/url.templateon router spans, reconciled onto the PR's restructuredinstrumentEmberAppInstanceForPerformance.ts.Build/tooling reconciliation
typescript: ~5.8.0devDependency pin.developupgraded to TypeScript 7 (the native compiler, which dropstypescript/lib/tsc), and glint's declaration build needs the classic JS compiler — the same stop-gapdevelopalready applies to ember (see chore(v11): Upgrade to TypeScript 7.0 #19435). Without the pin the declaration build fails withERR_PACKAGE_PATH_NOT_EXPORTED.@sentry/browser/@sentry/corefrom the PR's stale10.53.1to10.67.0and added@sentry/conventions(now imported by the ported instrumentation).import/no-unresolvedoxlint rule (doesn't exist in this repo's oxlint 1.75) and wrappedURL_FULLinfilterCollectedUrl()for thesdk/no-unfiltered-url-attributesrule, which now applies since the code lives undersrc/**.Test fixes
The originally-failing tests came down to three things:
captures correct spans for navigationassertions.traceLifecycle: 'static'in the two new e2e apps (ember-strict-resolver,ember-vite).developmade span-streaming the default and disables it in the ember test apps (test: Disable span streaming in remaining tests #22588); the new apps predated that, so their performance tests hung waiting for transaction events that never arrived under streaming.ember-strict-resolver'ssentry-performance.test.ts, updated from the oldui.ember.*op schema to the newrouter/function/ui.taskops.All four ember e2e apps pass (
ember-classic6/6,ember-embroider6/6,ember-strict-resolver10/10,ember-vite5/5), along with the ember unit tests, lint, and build.Supersedes #19229.