deps: Bump @sentry/nextjs from 10.71.0 to 10.72.0

[dependabot]

Bumps @sentry/nextjs from 10.71.0 to 10.72.0.

Release notes

Sourced from @​sentry/nextjs's releases.

10.72.0

Important Changes

• AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• fix(v10/node): Only end the process session when it is still ok (#23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

• chore(v10): Add external contributor to CHANGELOG.md (#23626)
• docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
• test(v10/e2e): Fix scripts for nuxt dev server (#23658)
• test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	27.1 KB
@​sentry/browser - with treeshaking flags	25.58 KB
@​sentry/browser (incl. Tracing)	45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.28 KB
@​sentry/browser (incl. Tracing, Profiling)	50.17 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.83 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.72.0

Important Changes

• AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• fix(v10/node): Only end the process session when it is still ok (#23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

• chore(v10): Add external contributor to CHANGELOG.md (#23626)
• docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#23641)
• test(v10/e2e): Fix scripts for nuxt dev server (#23658)
• test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

Commits

• 0d23628 release: 10.72.0
• ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
• f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
• 7917b0d feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737)
• b61e912 fix(v10/node): Only end the process session when it is still ok (#23731)
• 4316785 test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#23681)
• e09fdf8 fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• 817056d test(v10/e2e): Look up events via the organization trace endpoint (#23680)
• 83c644d fix(v10/server-utils): Stop shipping orchestrion bundler plugins as productio...
• 04a52dd fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.