fix: Bump bundler plugins to v5 (#19468)

andreiborza · chargome · web-flow · commit 8fc81d2cd404 · 2026-02-24T11:04:17.000+01:00
We released a new major v5 of the bundler plugins earlier today to fix security vulnerabilities. This PR bumps to the new sentry bundler plugins major for the same reason. Closes #19469 (added automatically) --------- Co-authored-by: Charly Gomez <charly.gomez@sentry.io>
diff --git a/dev-packages/e2e-tests/test-applications/browser-webworker-vite/package.json b/dev-packages/e2e-tests/test-applications/browser-webworker-vite/package.json
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@sentry/browser": "latest || *",
-    "@sentry/vite-plugin": "^4.8.0"
+    "@sentry/vite-plugin": "^5.1.0"
   },
   "volta": {
     "node": "20.19.2",
diff --git a/dev-packages/e2e-tests/test-applications/debug-id-sourcemaps/package.json b/dev-packages/e2e-tests/test-applications/debug-id-sourcemaps/package.json
@@ -15,7 +15,7 @@
   "devDependencies": {
     "rollup": "^4.35.0",
     "vitest": "^0.34.6",
-    "@sentry/rollup-plugin": "^4.8.0"
+    "@sentry/rollup-plugin": "^5.1.0"
   },
   "volta": {
     "extends": "../../package.json"
diff --git a/dev-packages/e2e-tests/test-applications/hydrogen-react-router-7/package.json b/dev-packages/e2e-tests/test-applications/hydrogen-react-router-7/package.json
@@ -16,7 +16,7 @@
   "dependencies": {
     "@sentry/cloudflare": "latest || *",
     "@sentry/react-router": "latest || *",
-    "@sentry/vite-plugin": "^4.8.0",
+    "@sentry/vite-plugin": "^5.1.0",
     "@shopify/hydrogen": "2025.5.0",
     "@shopify/remix-oxygen": "^3.0.0",
     "graphql": "^16.10.0",
diff --git a/dev-packages/e2e-tests/test-applications/remix-hydrogen/package.json b/dev-packages/e2e-tests/test-applications/remix-hydrogen/package.json
@@ -19,7 +19,7 @@
     "@remix-run/cloudflare-pages": "^2.17.4",
     "@sentry/cloudflare": "latest || *",
     "@sentry/remix": "latest || *",
-    "@sentry/vite-plugin": "^4.8.0",
+    "@sentry/vite-plugin": "^5.1.0",
     "@shopify/hydrogen": "2025.4.0",
     "@shopify/remix-oxygen": "2.0.10",
     "graphql": "^16.6.0",
diff --git a/packages/astro/package.json b/packages/astro/package.json
@@ -59,7 +59,7 @@
     "@sentry/browser": "10.39.0",
     "@sentry/core": "10.39.0",
     "@sentry/node": "10.39.0",
-    "@sentry/vite-plugin": "^4.8.0"
+    "@sentry/vite-plugin": "^5.1.0"
   },
   "devDependencies": {
     "astro": "^3.5.0",
diff --git a/packages/gatsby/package.json b/packages/gatsby/package.json
@@ -47,7 +47,7 @@
   "dependencies": {
     "@sentry/core": "10.39.0",
     "@sentry/react": "10.39.0",
-    "@sentry/webpack-plugin": "^4.8.0"
+    "@sentry/webpack-plugin": "^5.1.0"
   },
   "peerDependencies": {
     "gatsby": "^3.0.0 || ^4.0.0 || ^5.0.0",
diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
@@ -80,13 +80,13 @@
     "@opentelemetry/semantic-conventions": "^1.37.0",
     "@rollup/plugin-commonjs": "28.0.1",
     "@sentry-internal/browser-utils": "10.39.0",
-    "@sentry/bundler-plugin-core": "^4.9.0",
+    "@sentry/bundler-plugin-core": "^5.1.0",
     "@sentry/core": "10.39.0",
     "@sentry/node": "10.39.0",
     "@sentry/opentelemetry": "10.39.0",
     "@sentry/react": "10.39.0",
     "@sentry/vercel-edge": "10.39.0",
-    "@sentry/webpack-plugin": "^4.8.0",
+    "@sentry/webpack-plugin": "^5.1.0",
     "rollup": "^4.35.0",
     "stacktrace-parser": "^0.1.10"
   },
diff --git a/packages/nuxt/package.json b/packages/nuxt/package.json
@@ -54,8 +54,8 @@
     "@sentry/core": "10.39.0",
     "@sentry/node": "10.39.0",
     "@sentry/node-core": "10.39.0",
-    "@sentry/rollup-plugin": "^4.8.0",
-    "@sentry/vite-plugin": "^4.8.0",
+    "@sentry/rollup-plugin": "^5.1.0",
+    "@sentry/vite-plugin": "^5.1.0",
     "@sentry/vue": "10.39.0"
   },
   "devDependencies": {
diff --git a/packages/react-router/package.json b/packages/react-router/package.json
@@ -54,7 +54,7 @@
     "@sentry/core": "10.39.0",
     "@sentry/node": "10.39.0",
     "@sentry/react": "10.39.0",
-    "@sentry/vite-plugin": "^4.8.0",
+    "@sentry/vite-plugin": "^5.1.0",
     "glob": "^13.0.1"
   },
   "devDependencies": {
diff --git a/packages/react-router/src/vite/makeCustomSentryVitePlugins.ts b/packages/react-router/src/vite/makeCustomSentryVitePlugins.ts
@@ -42,22 +42,11 @@ export async function makeCustomSentryVitePlugins(options: SentryReactRouterBuil
     },
     // will be handled in buildEnd hook
     sourcemaps: {
-      disable: true,
+      disable: 'disable-upload',
       ...unstable_sentryVitePluginOptions?.sourcemaps,
     },
     ...unstable_sentryVitePluginOptions,
   }) as Plugin[];
 
-  // only use a subset of the plugins as all upload and file deletion tasks will be handled in the buildEnd hook
-  return [
-    ...sentryVitePlugins.filter(plugin => {
-      return [
-        'sentry-telemetry-plugin',
-        'sentry-vite-injection-plugin',
-        ...(reactComponentAnnotation?.enabled || unstable_sentryVitePluginOptions?.reactComponentAnnotation?.enabled
-          ? ['sentry-vite-component-name-annotate-plugin']
-          : []),
-      ].includes(plugin.name);
-    }),
-  ];
+  return sentryVitePlugins;
 }
diff --git a/packages/react-router/test/vite/makeCustomSentryVitePlugins.test.ts b/packages/react-router/test/vite/makeCustomSentryVitePlugins.test.ts
@@ -3,14 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { makeCustomSentryVitePlugins } from '../../src/vite/makeCustomSentryVitePlugins';
 
 vi.mock('@sentry/vite-plugin', () => ({
-  sentryVitePlugin: vi
-    .fn()
-    .mockReturnValue([
-      { name: 'sentry-telemetry-plugin' },
-      { name: 'sentry-vite-injection-plugin' },
-      { name: 'sentry-vite-component-name-annotate-plugin' },
-      { name: 'other-plugin' },
-    ]),
+  sentryVitePlugin: vi.fn().mockReturnValue([{ name: 'sentry-vite-plugin' }]),
 }));
 
 describe('makeCustomSentryVitePlugins', () => {
@@ -55,30 +48,40 @@ describe('makeCustomSentryVitePlugins', () => {
     );
   });
 
-  it('should only return telemetry and release injection plugins', async () => {
+  it('should return all plugins from sentryVitePlugin', async () => {
     const plugins = await makeCustomSentryVitePlugins({});
-    expect(plugins).toHaveLength(2);
-    expect(plugins?.[0]?.name).toBe('sentry-telemetry-plugin');
-    expect(plugins?.[1]?.name).toBe('sentry-vite-injection-plugin');
+    expect(plugins).toHaveLength(1);
+    expect(plugins?.[0]?.name).toBe('sentry-vite-plugin');
   });
 
-  it('should include component annotation plugin when reactComponentAnnotation.enabled is true', async () => {
-    const plugins = await makeCustomSentryVitePlugins({ reactComponentAnnotation: { enabled: true } });
+  it('should disable sourcemap upload with "disable-upload" by default', async () => {
+    await makeCustomSentryVitePlugins({});
 
-    expect(plugins).toHaveLength(3);
-    expect(plugins?.[0]?.name).toBe('sentry-telemetry-plugin');
-    expect(plugins?.[1]?.name).toBe('sentry-vite-injection-plugin');
-    expect(plugins?.[2]?.name).toBe('sentry-vite-component-name-annotate-plugin');
+    expect(sentryVitePlugin).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sourcemaps: expect.objectContaining({
+          disable: 'disable-upload',
+        }),
+      }),
+    );
   });
 
-  it('should include component annotation plugin when unstable_sentryVitePluginOptions.reactComponentAnnotation.enabled is true', async () => {
-    const plugins = await makeCustomSentryVitePlugins({
-      unstable_sentryVitePluginOptions: { reactComponentAnnotation: { enabled: true } },
+  it('should allow overriding sourcemaps via unstable_sentryVitePluginOptions', async () => {
+    await makeCustomSentryVitePlugins({
+      unstable_sentryVitePluginOptions: {
+        sourcemaps: {
+          assets: ['dist/**'],
+        },
+      },
     });
 
-    expect(plugins).toHaveLength(3);
-    expect(plugins?.[0]?.name).toBe('sentry-telemetry-plugin');
-    expect(plugins?.[1]?.name).toBe('sentry-vite-injection-plugin');
-    expect(plugins?.[2]?.name).toBe('sentry-vite-component-name-annotate-plugin');
+    // unstable_sentryVitePluginOptions is spread last, so it fully overrides sourcemaps
+    expect(sentryVitePlugin).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sourcemaps: {
+          assets: ['dist/**'],
+        },
+      }),
+    );
   });
 });
diff --git a/packages/solidstart/package.json b/packages/solidstart/package.json
@@ -69,7 +69,7 @@
     "@sentry/core": "10.39.0",
     "@sentry/node": "10.39.0",
     "@sentry/solid": "10.39.0",
-    "@sentry/vite-plugin": "^4.8.0"
+    "@sentry/vite-plugin": "^5.1.0"
   },
   "devDependencies": {
     "@solidjs/router": "^0.15.0",
diff --git a/packages/solidstart/test/config/withSentry.test.ts b/packages/solidstart/test/config/withSentry.test.ts
@@ -79,11 +79,7 @@ describe('withSentry()', () => {
     const names = config?.vite.plugins.flat().map((plugin: Plugin) => plugin.name);
     expect(names).toEqual([
       'sentry-solidstart-build-instrumentation-file',
-      'sentry-telemetry-plugin',
-      'sentry-vite-injection-plugin',
-      'sentry-release-management-plugin',
-      'sentry-vite-debug-id-upload-plugin',
-      'sentry-file-deletion-plugin',
+      'sentry-vite-plugin',
       'sentry-solidstart-update-source-map-setting',
     ]);
   });
@@ -106,11 +102,7 @@ describe('withSentry()', () => {
     const names = config?.vite.plugins.flat().map((plugin: Plugin) => plugin.name);
     expect(names).toEqual([
       'sentry-solidstart-build-instrumentation-file',
-      'sentry-telemetry-plugin',
-      'sentry-vite-injection-plugin',
-      'sentry-release-management-plugin',
-      'sentry-vite-debug-id-upload-plugin',
-      'sentry-file-deletion-plugin',
+      'sentry-vite-plugin',
       'sentry-solidstart-update-source-map-setting',
       'my-test-plugin',
     ]);
@@ -137,11 +129,7 @@ describe('withSentry()', () => {
       .map((plugin: Plugin) => plugin.name);
     expect(names).toEqual([
       'sentry-solidstart-build-instrumentation-file',
-      'sentry-telemetry-plugin',
-      'sentry-vite-injection-plugin',
-      'sentry-release-management-plugin',
-      'sentry-vite-debug-id-upload-plugin',
-      'sentry-file-deletion-plugin',
+      'sentry-vite-plugin',
       'sentry-solidstart-update-source-map-setting',
       'my-test-plugin',
     ]);
diff --git a/packages/solidstart/test/vite/sentrySolidStartVite.test.ts b/packages/solidstart/test/vite/sentrySolidStartVite.test.ts
@@ -27,11 +27,7 @@ describe('sentrySolidStartVite()', () => {
     const names = plugins.map(plugin => plugin.name);
     expect(names).toEqual([
       'sentry-solidstart-build-instrumentation-file',
-      'sentry-telemetry-plugin',
-      'sentry-vite-injection-plugin',
-      'sentry-release-management-plugin',
-      'sentry-vite-debug-id-upload-plugin',
-      'sentry-file-deletion-plugin',
+      'sentry-vite-plugin',
       'sentry-solidstart-update-source-map-setting',
     ]);
   });
diff --git a/packages/sveltekit/package.json b/packages/sveltekit/package.json
@@ -52,7 +52,7 @@
     "@sentry/core": "10.39.0",
     "@sentry/node": "10.39.0",
     "@sentry/svelte": "10.39.0",
-    "@sentry/vite-plugin": "^4.8.0",
+    "@sentry/vite-plugin": "^5.1.0",
     "magic-string": "0.30.7",
     "recast": "0.23.11",
     "sorcery": "1.0.0"
diff --git a/packages/sveltekit/src/vite/sourceMaps.ts b/packages/sveltekit/src/vite/sourceMaps.ts
diff --git a/packages/sveltekit/test/vite/sentrySvelteKitPlugins.test.ts b/packages/sveltekit/test/vite/sentrySvelteKitPlugins.test.ts
diff --git a/packages/sveltekit/test/vite/sourceMaps.test.ts b/packages/sveltekit/test/vite/sourceMaps.test.ts
diff --git a/packages/tanstackstart-react/package.json b/packages/tanstackstart-react/package.json
diff --git a/yarn.lock b/yarn.lock
