[Gitflow] Merge master into develop

…2081)

This mainly bumps transitive dependencies to be better aligned.

This was forgotten/got lost while we migrated this from v7 to v8. Now,
adding the dsn again when the tunnel is enabled.

Fixes #12094

Users can pass `ignoreResolveSpans` and `ignoreTrivalResolveSpans` to
the integration now, which is passed to the instrumentation. They
default to `true`. This should reduce noise and perf overhead.

Closes #12092

Our nest e2e test was not fully correct, and did not test the creation
of actual nest.js core spans (only http & express spans).

This updates the test setup & check to account for this.

…rk (#12100)

It was brought up
#12013 that
importing Sentry as a default import is not working anymore in v8. While
this was never officially supported (and also not "removed" on purpose,
it just seemed to have worked incidentally before), I do not really
consider this a "breaking change", but, as pointed out in the issue, it
is still helpful to point this out in the migration docs, for users who
incidentally did this before.

We should also add this to migration docs on docs.sentry.io.

This ensures we have correct op, name & origin for all fastify
middleware spans.

Sadly, we have no good hook in fastify to handle all spans it emits -
only `request_handler` spans are passed to `requestHook` 😬 so I opted to
add a `spanStart` hook to handle this. Since it would suck to always
register this, even without fastify being used, I put this into the
fastify error handler - kind of mixing concerns there but I'd say it's
fine for this case (as it just enhances the data).

I had some issues running this locally, so I changed the playwright
config to not be TS which is IMHO ok and simplifies the setup a bit...

This ensures we have correct op, name & origin for all express
middleware spans.

I also updated the E2E test to actually check this as well.

…12125)

These params are optional, to the TS typedef should align with that.

**Before:**
<img width="1008" alt="SCR-20240520-ltyb"
src="https://github.com/getsentry/sentry-javascript/assets/187460/8d242640-f67a-406d-a963-9b40fea1de54">


**After:**
<img width="1089" alt="SCR-20240520-ltvg"
src="https://github.com/getsentry/sentry-javascript/assets/187460/71d98556-9151-4146-8de9-6504e22d4731">

Related to #12015

This ensures we have correct op, name & origin for all koa middleware
spans.

I also updated the E2E test to actually check this as well.

I also noticed a problem in the instrumentation where the name is
sometimes empty here, opened an upstream issue:
open-telemetry/opentelemetry-js-contrib#2220
to look into this.

…arning (#12136)

Ensuring connect spans have correct op & origin.

Also streamlining E2E test app for this.

Hopefully fixes
#12114??

To make debugging etc. easier for us in the future.

Cloudflare workers Node compatibility mode requires that all node
built-ins are loaded with the `node:` prefix.

`@sentry/node` still wont work in compat mode for now because our
dependencies (ie. otel) are not using the prefix, I guess due to their
current Node version support. They state that they support Node v14 but
v14.18 is required to use the prefix.

Ensure op and origin is correctly set.

Ensure we have an op and origin for hapi spans.

In getsentry/sentry-python#3029 it was raised
that we need to make sure the SDK MIT License has an up-to-date year. We
also need to make it a range.

In this PR I went ahead and updated the dates accordingly, changed the
license to directly reference `Functional Software, Inc. dba Sentry`,
and re-aligned all the Licenses of individual packages to have the same
format and structure.

…t auto-dark mode when a theme is picked (#12126)

If the developer sets `theme: 'dark'` or `theme: 'light'` in their
sentry config, then we should prevent the browser from applying
auto-dark mode to the widget. That mode guesses at the correct color to
use, and sometimes gets it wrong

Also, I've picked a better color for the border in dark mode.

There are a few states to test:
- OS is light/dark (flows into `prefers-color-scheme` media query)
- Emulate Dark true/false
- SDK config light/dark

which refer to these 2 settings inside the chrome devtools:
<img width="398" alt="SCR-20240520-mhiz"
src="https://github.com/getsentry/sentry-javascript/assets/187460/40391ea6-11dc-479d-8464-349e96c2b0ce">

Note:images show a slightly different border than what's implemented. 

| OS Config | Emulate Config | SDK Config | Before | After |
| --- | --- | --- | --- | --- |
| prefers-color-scheme: light | emulate: false | theme: light | <img
width="312" alt="before light false light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/9102a046-381a-4a28-bf72-ffe28e94cc7d">
| <img width="305" alt="after light false light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/61fc16f9-29c0-4e4a-ac24-71fc12b29325">
|
| prefers-color-scheme: light | emulate: false | theme: dark | <img
width="307" alt="before light false dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/c1465d70-c0b6-4384-9ac2-13eb876e4a5b">
| <img width="301" alt="after light false dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/1c815105-c1ce-4681-b6da-719ae11f4406">
|
| prefers-color-scheme: light | emulate: true | theme: light | <img
width="303" alt="before light true light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/30d90b6f-df99-4ea8-b1ff-a15a5486a91e">
| <img width="296" alt="after light true light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/a3097c0e-1a63-4f49-b794-80ddcc7bfaf4">
|
| prefers-color-scheme: light | emulate: true | theme: dark | <img
width="307" alt="before light true dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/3cae1240-f810-4a4a-971a-15cf67f048d7">
| <img width="301" alt="after light true dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/95161791-05ea-4deb-9adc-4151a2db0afa">
|
| prefers-color-scheme: dark | emulate: false | theme: light | <img
width="299" alt="before dark false light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/bfbc33c1-8cc2-457b-8f46-61a9fc141c2c">
| <img width="303" alt="after dark false light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/02839776-41cd-46ba-ba6a-ac8f723db16c">
|
| prefers-color-scheme: dark | emulate: false | theme: dark | <img
width="305" alt="before dark false dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/9e42bf3a-c685-4a63-9f4c-82da932ebe4d">
| <img width="302" alt="after dark false dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/66c8b988-04d6-4de7-8418-8279d1af5326">
|
| prefers-color-scheme: dark | emulate: true | theme: light | <img
width="299" alt="before dark true light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/b5a5ab64-69a0-4939-a7ae-ec94806f423e">
| <img width="302" alt="after dark true light"
src="https://github.com/getsentry/sentry-javascript/assets/187460/f4adfbf8-cce3-4e07-8c9a-e723a1b73d4e">
|
| prefers-color-scheme: dark | emulate: true | theme: dark | <img
width="302" alt="before dark true dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/0e9cccae-ee8a-457c-9fb3-6b228e9d4089">
| <img width="311" alt="after dark true dark"
src="https://github.com/getsentry/sentry-javascript/assets/187460/24d9cf3e-0b72-4eaf-bf42-2738bb9d09b0">
|

References: 
- https://developer.chrome.com/blog/auto-dark-theme
-
https://developer.chrome.com/docs/devtools/rendering/emulate-css#emulate_css_media_feature_prefers-color-scheme

Adds support for
https://nodejs.org/api/process.html#processavailablememory introduced
with Node 22

App Context:
https://develop.sentry.dev/sdk/event-payloads/contexts/#app-context

ref #11455

Adds #10780 to the
migration guide.

This exposes the ESM build for `@sentry/google-cloud-serverless`, with
the caveat that the performance related instrumentation does not work
atm. These need to be ported to use OpenTelemetry instrumentation.

…12141)

Also gives a better warning in ESM mode with a helpful link to the docs.

This PR ensures that (node) fetch and http requests generate breadcrumbs
correctly, even if tracing is disabled.

It also adds tests for this, and ensures we pass the request/response to
the hint correctly.

Fixes #12132

Remove quotes around process.env.SENTRY_AUTH_TOKEN

…DN (#12158)

Closes #12156

…o 0.39.0 (#12079)

Bumps
[@opentelemetry/instrumentation-express](https://github.com/open-telemetry/opentelemetry-js-contrib)
from 0.38.0 to 0.39.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/releases"><code>@​opentelemetry/instrumentation-express</code>'s
releases</a>.</em></p>
<blockquote>
<h2>instrumentation-express: v0.39.0</h2>
<h2><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/instrumentation-express-v0.38.0...instrumentation-express-v0.39.0">0.39.0</a>
(2024-05-15)</h2>
<h3>Features</h3>
<ul>
<li><strong>instrumentation-express:</strong> Support non-string routes
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2008">#2008</a>)
(<a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/525bbba67accc20eeb96899ab7dc9ccb125a4b2d">525bbba</a>)</li>
</ul>
<h2>instrumentation-pino: v0.39.0</h2>
<h2><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/instrumentation-pino-v0.38.0...instrumentation-pino-v0.39.0">0.39.0</a>
(2024-05-02)</h2>
<h3>Features</h3>
<ul>
<li><strong>pino:</strong> support new pino version ^9.0.0 (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2163">#2163</a>)
(<a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/585b833dc8e911c17b483e871f752ad4988cee5a">585b833</a>)</li>
</ul>
<h2>instrumentation-mysql: v0.38.1</h2>
<h2><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/instrumentation-mysql-v0.38.0...instrumentation-mysql-v0.38.1">0.38.1</a>
(2024-05-02)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>remove unuseful patch message from instrumentations (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2161">#2161</a>)
(<a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/34f56e0e28a0873b69a499c9e91798b19fea8e96">34f56e0</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/b31df370ce61a60a407495cac665c4131ca8dfb9"><code>b31df37</code></a>
chore: release main (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2083">#2083</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/f3406ea864ec614dd4c26b4baf8c44c50ef7d504"><code>f3406ea</code></a>
chore: remove patch and unpatch diag from instrumentations (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2107">#2107</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/73e01f281d2823e7f81e3efee2e0cb2a24e528e5"><code>73e01f2</code></a>
chore(examples/graphql): use exported strings for attributes (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2122">#2122</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/80cbee73130c65c8ccd78384485a7be8d2a4a84b"><code>80cbee7</code></a>
chore: experimental 0.51.0, remove instrumentations generic type to
align wit...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/46b67752b001d428a1f5c315ca287300e9444dc7"><code>46b6775</code></a>
test(instr-document-load): fix test to allow missing network span events
(<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2145">#2145</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/931318cac21ee3707f3735a64ac751566ee37182"><code>931318c</code></a>
refactor(instr-aws-sdk): use exported strings for attributes (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2142">#2142</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/77452c1640bca9c10dd62ee47a0a603f6c4b05dd"><code>77452c1</code></a>
chore(examples/connect): use exported strings for attributes (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2120">#2120</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/5f1910b75b45b5d751162fb20841d9ae5f0b59f3"><code>5f1910b</code></a>
chore(examples/web): use exported strings for attributes (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2129">#2129</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/0d380816aabdbaab54d55e34410c1c10543e2062"><code>0d38081</code></a>
docs: remove <code>key</code> column on readme (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2132">#2132</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/2d709ecc73a6b3d99967ec7d2bd814e5ef10c4cc"><code>2d709ec</code></a>
chore(instrumentation-fs): remove unused semconv package (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/2141">#2141</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/instrumentation-pg-v0.38.0...contrib-test-utils-v0.39.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@opentelemetry/instrumentation-express&package-manager=npm_and_yarn&previous-version=0.38.0&new-version=0.39.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Francesco Novy <francesco.novy@sentry.io>

… detection (#11924)

This PR makes sure we use the native, unwrapped `setTimeout`
implementation of the browser. Some environments, e.g. Angular, monkey
patch this for their change detection, leading to performance issues
(possibly). We have already changed this in rrweb, but we also have some
usage of this in replay itself.

This PR _should_ work fine, however all test fail today because we
heavily use `jest.useFakeTimers()`, which basically monkey patches fetch
too. So with this change, we do not use the patched timers, leading to
everything blowing up 🤯


Based on #11864
Depends on #11899

---------

Co-authored-by: Francesco Novy <francesco.novy@sentry.io>

I noticed we were getting some build warnings for circular dependency
issues, which indicated that madge was not correctly capturing all
issues. So I went ahead and updated madge to latest, and aligned the
setup, which actually surfaced problems again more correctly.

I also fixed all the circular dep issues that were raised there. We
still have a bunch of types-related circular deps but these are hard to
solve, so let's ignore this for now.