Bump @sentry/browser from 10.19.0 to 10.20.0

[dependabot]

Bumps @sentry/browser from 10.19.0 to 10.20.0.

Release notes

Sourced from @​sentry/browser's releases.

10.20.0

Important Changes

• feat(flags): Add Growthbook integration (#17440)

  Adds a new Growthbook integration for feature flag support.

• feat(solid): Add support for TanStack Router Solid (#17735)

  Adds support for TanStack Router in the Solid SDK, enabling better routing instrumentation for Solid applications.

• feat(nextjs): Support native debugIds in turbopack (#17853)

  Adds support for native Debug IDs in Turbopack, improving source map resolution and error tracking for Next.js applications using Turbopack. Native Debug ID generation will be enabled automatically for compatible versions.

Other Changes

• feat(nextjs): Prepare for next 16 bundler default (#17868)
• feat(node): Capture pino logger name (#17930)
• fix(browser): Ignore React 19.2+ component render measure entries (#17905)
• fix(nextjs): Fix createRouteManifest with basePath (#17838)
• fix(react): Add POP guard for long-running pageload spans (#17867)
• fix(tracemetrics): Send boolean for internal replay attribute (#17908)
• ref(core): Add weight tracking logic to browser logs/metrics (#17901)

• chore(nextjs): Add Next.js 16 peer dependency (#17925)
• chore(ci): Update Next.js canary testing (#17939)
• chore: Bump size limit (#17941)
• test(nextjs): Add next@16 e2e test (#17922)
• test(nextjs): Update next 15 tests (#17919)
• chore: Add external contributor to CHANGELOG.md (#17915)
• chore: Add external contributor to CHANGELOG.md (#17928)
• chore: Add external contributor to CHANGELOG.md (#17940)

Work in this release was contributed by @​seoyeon9888, @​madhuchavva and @​thedanchez . Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	24.07 KB
@​sentry/browser - with treeshaking flags	22.6 KB
@​sentry/browser (incl. Tracing)	39.89 KB
@​sentry/browser (incl. Tracing, Replay)	77.35 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.20.0

Important Changes

• feat(flags): Add Growthbook integration (#17440)

  Adds a new Growthbook integration for feature flag support.

• feat(solid): Add support for TanStack Router Solid (#17735)

  Adds support for TanStack Router in the Solid SDK, enabling better routing instrumentation for Solid applications.

• feat(nextjs): Support native debugIds in turbopack (#17853)

  Adds support for native Debug IDs in Turbopack, improving source map resolution and error tracking for Next.js applications using Turbopack. Native Debug ID generation will be enabled automatically for compatible versions.

Other Changes

• feat(nextjs): Prepare for next 16 bundler default (#17868)
• feat(node): Capture pino logger name (#17930)
• fix(browser): Ignore React 19.2+ component render measure entries (#17905)
• fix(nextjs): Fix createRouteManifest with basePath (#17838)
• fix(react): Add POP guard for long-running pageload spans (#17867)
• fix(tracemetrics): Send boolean for internal replay attribute (#17908)
• ref(core): Add weight tracking logic to browser logs/metrics (#17901)

Work in this release was contributed by @​seoyeon9888, @​madhuchavva and @​thedanchez. Thank you for your contributions!

Commits

• b3c7141 release: 10.20.0
• cc4d168 Merge pull request #17943 from getsentry/prepare-release/10.20.0
• baa7a06 meta(changelog): Update changelog for 10.20.0
• e557d38 fix(tracemetrics): Send boolean for internal replay attribute (#17908)
• fc64c47 fix(react): Add POP guard for long-running pageload spans (#17867)
• 05122e0 chore: Add external contributor to CHANGELOG.md (#17940)
• e2fe686 chore: Bump size limit (#17941)
• fdbce16 chore(ci): Update Next.js canary testing (#17939)
• e4e272b feat(solid): Add support for TanStack Router Solid (#17735)
• c68674a fix(browser): Ignore React 19.2+ component render measure entries (#17905)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automerge 🤞, type: dependencies 🔗. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
astro-webstackbuilders-com	Ready	Preview	Comment	Oct 21, 2025 2:28am

💡 Enable Vercel Agent with $100 free credit for automated AI reviews

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/@emnapi/core	1.5.0	🟢 4.3	Details Check Score Reason Maintained 🟢 10 18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy ⚠️ 0 security policy file not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@emnapi/wasi-threads	1.1.0	🟢 4.3	Details Check Score Reason Maintained 🟢 10 18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy ⚠️ 0 security policy file not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@napi-rs/wasm-runtime	0.2.12	🟢 5.4	Details Check Score Reason Code-Review 🟢 3 Found 9/26 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Vulnerabilities 🟢 10 0 existing vulnerabilities detected
npm/@napi-rs/wasm-runtime	1.0.5	🟢 5.4	Details Check Score Reason Code-Review 🟢 3 Found 9/26 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Vulnerabilities 🟢 10 0 existing vulnerabilities detected
npm/@sentry-internal/browser-utils	10.20.0	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 78 existing vulnerabilities detected SAST 🟢 7 SAST tool detected but not run on all commits
npm/@sentry-internal/feedback	10.20.0	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 78 existing vulnerabilities detected SAST 🟢 7 SAST tool detected but not run on all commits
npm/@sentry-internal/replay	10.20.0	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 78 existing vulnerabilities detected SAST 🟢 7 SAST tool detected but not run on all commits
npm/@sentry-internal/replay-canvas	10.20.0	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 78 existing vulnerabilities detected SAST 🟢 7 SAST tool detected but not run on all commits
npm/@sentry/browser	10.20.0	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 78 existing vulnerabilities detected SAST 🟢 7 SAST tool detected but not run on all commits
npm/@sentry/core	10.20.0	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 78 existing vulnerabilities detected SAST 🟢 7 SAST tool detected but not run on all commits
npm/@tybys/wasm-util	0.10.1	Unknown	Unknown
npm/@sentry/browser	^10.20.0	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 25 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing ⚠️ 0 project is not fuzzed Vulnerabilities ⚠️ 0 78 existing vulnerabilities detected SAST 🟢 7 SAST tool detected but not run on all commits

Scanned Files

• package-lock.json
• package.json

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.