Migrate Sentry from @sentry/nextjs to @sentry/node + @sentry/react for VineXT#1044
Migrate Sentry from @sentry/nextjs to @sentry/node + @sentry/react for VineXT#1044
Conversation
📝 WalkthroughWalkthroughThe changes migrate from Next.js-based build tooling to Vite with vinext, replace the monolithic Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@vite.config.ts`:
- Around line 1-29: Update and pin the vulnerable/experimental dev dependencies:
bump `@vitejs/plugin-rsc` to at least 0.5.8 (prefer latest stable >=0.5.8) and
lock the version in package.json to prevent automatic regresses, and either
replace or gate use of vinext (the vinext() plugin) for production—either remove
it from the production plugin list, add a runtime/build-time opt-in flag (e.g.,
only include vinext() when process.env.ENABLE_VINEXT === "true"), or replace it
with a supported alternative; also confirm sentryVitePlugin remains configured
to skip uploads when process.env.SENTRY_AUTH_TOKEN is unset (no change needed)
and run `npm audit`/`npm ci` to verify no transitive vulnerable versions remain.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (9)
next.config.tspackage.jsonsentry.edge.config.tssentry.server.config.tssrc/app/global-error.tsxsrc/instrumentation-client.tssrc/instrumentation.tssrc/pages/_error.tsxvite.config.ts
💤 Files with no reviewable changes (1)
- sentry.edge.config.ts
| import { defineConfig } from "vite"; | ||
| import vinext from "vinext"; | ||
| import rsc from "@vitejs/plugin-rsc"; | ||
| import { cloudflare } from "@cloudflare/vite-plugin"; | ||
| import { sentryVitePlugin } from "@sentry/vite-plugin"; | ||
|
|
||
| export default defineConfig({ | ||
| plugins: [ | ||
| vinext(), | ||
| rsc({ | ||
| entries: { | ||
| rsc: "virtual:vinext-rsc-entry", | ||
| ssr: "virtual:vinext-app-ssr-entry", | ||
| client: "virtual:vinext-app-browser-entry", | ||
| }, | ||
| }), | ||
| cloudflare({ | ||
| viteEnvironment: { name: "rsc", childEnvironments: ["ssr"] }, | ||
| }), | ||
| sentryVitePlugin({ | ||
| org: "promptschat", | ||
| project: "prompts-chat", | ||
| authToken: process.env.SENTRY_AUTH_TOKEN, | ||
| sourcemaps: { | ||
| filesToDeleteAfterUpload: ["**/*.map"], | ||
| }, | ||
| }), | ||
| ], | ||
| }); |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
vinext vite plugin stability documentation
💡 Result:
Vinext’s own docs currently describe its stability as experimental / use-at-your-own-risk:
- GitHub README (cloudflare/vinext): explicitly labels the project “Experimental — under heavy development” and warns that most code/docs were AI-written and not line-by-line reviewed, so expect bugs/rough edges. [1]
- Cloudflare announcement post: includes a “Status: experimental” section and notes it’s very new and not yet validated at large, meaningful traffic, advising caution for production evaluation. [2]
Related dependency note: vinext relies on Vite’s Environment API, which Vite documents as release-candidate with some parts still experimental until a future major release. [3]
Sources: [1] [2] [3]
🌐 Web query:
@vitejs/plugin-rsc react server components vite plugin
💡 Result:
@vitejs/plugin-rsc is the official Vite plugin that adds React Server Components (RSC) support, built on Vite’s Environment API and intended to provide low-level primitives that frameworks (and custom app code) can build on. It supports HMR and handles CSS splitting/injection for server components. [1][2]
Quick start
- Create a minimal RSC app from Vite’s template:
npm create vite@latest -- --template rsc[1]
Typical Vite config shape (3 entries)
RSC apps commonly define separate entry points for:
- client (browser)
- rsc (RSC request handler / RSC stream)
- ssr (HTML rendering that can consume the RSC stream)
React Router’s RSC guide shows this pattern and a working vite.config.ts using @vitejs/plugin-rsc with entries: { client, rsc, ssr }. [3]
Notable plugin APIs (from the plugin docs/README)
import.meta.viteRsc.loadModule("ssr" | "rsc", entryName)for cross-environment module loading (dev and build behavior differs). [2]- Runtime re-exports for
react-server-domvia:@vitejs/plugin-rsc/rsc,@vitejs/plugin-rsc/ssr,@vitejs/plugin-rsc/browser. [2]
Security notes (important if you used older versions)
- GitHub advisory: versions
<= 0.5.2were affected by an RSC-related unauthenticated RCE issue; patched in0.5.3. [4] - CVE-2025-68155: an arbitrary file read issue in dev mode existed prior to
0.5.8; upgrade to0.5.8+. [5]
Related ecosystem note
Cloudflare’s Vite plugin added improved integration guidance around @vitejs/plugin-rsc (multi-environment/child environments) in Feb 2026. [6]
Sources: Vite docs [1], plugin README on npm (mirrored snippet) [2], React Router RSC guide [3], GitHub security advisory [4], GitLab advisory database [5], Cloudflare changelog [6].
🏁 Script executed:
find . -name "package.json" -type f | head -5Repository: f/prompts.chat
Length of output: 151
🏁 Script executed:
cat ./package.json | grep -A 10 '"dependencies"\|"devDependencies"' | head -50Repository: f/prompts.chat
Length of output: 817
🏁 Script executed:
cat ./packages/prompts.chat/package.json | grep -E '"vinext"|"@vitejs/plugin-rsc"|"@sentry/vite-plugin"'Repository: f/prompts.chat
Length of output: 40
🏁 Script executed:
# Also check for any environment variable handling or conditional Sentry setup
rg "SENTRY_AUTH_TOKEN" --type ts --type jsonRepository: f/prompts.chat
Length of output: 120
🏁 Script executed:
cat ./packages/prompts.chat/package.json | grep -E "vinext|plugin-rsc|sentry/vite-plugin" -A 1 -B 1Repository: f/prompts.chat
Length of output: 40
🏁 Script executed:
# Check the full devDependencies section to find the exact versions
jq '.devDependencies | to_entries[] | select(.key | test("vinext|plugin-rsc|sentry"))' ./packages/prompts.chat/package.jsonRepository: f/prompts.chat
Length of output: 40
🏁 Script executed:
cat ./packages/prompts.chat/package.jsonRepository: f/prompts.chat
Length of output: 2595
🏁 Script executed:
cat ./package.jsonRepository: f/prompts.chat
Length of output: 4200
Verify security patches for @vitejs/plugin-rsc and address experimental package stability.
The configuration uses pre-1.0 experimental packages with known issues:
- @vitejs/plugin-rsc@^0.5.21: Versions before 0.5.8 contain a critical arbitrary file read vulnerability in dev mode (CVE-2025-68155). Ensure the installed version is >= 0.5.8. Also had an RCE issue in versions <= 0.5.2.
- vinext@^0.0.15: Cloudflare explicitly marks this as "Experimental — under heavy development" with AI-written, unreviewed code. The project depends on Vite's experimental Environment API and is not yet validated at meaningful traffic levels. Production use carries significant risk.
The process.env.SENTRY_AUTH_TOKEN being undefined in local development is acceptable; the Sentry Vite plugin (v5.1.1) handles missing tokens gracefully by skipping sourcemap upload.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@vite.config.ts` around lines 1 - 29, Update and pin the
vulnerable/experimental dev dependencies: bump `@vitejs/plugin-rsc` to at least
0.5.8 (prefer latest stable >=0.5.8) and lock the version in package.json to
prevent automatic regresses, and either replace or gate use of vinext (the
vinext() plugin) for production—either remove it from the production plugin
list, add a runtime/build-time opt-in flag (e.g., only include vinext() when
process.env.ENABLE_VINEXT === "true"), or replace it with a supported
alternative; also confirm sentryVitePlugin remains configured to skip uploads
when process.env.SENTRY_AUTH_TOKEN is unset (no change needed) and run `npm
audit`/`npm ci` to verify no transitive vulnerable versions remain.
2 participants
Summary
@sentry/nextjswith@sentry/node(server),@sentry/react(client), and@sentry/vite-plugin(build-time sourcemap upload)vinext,@vitejs/plugin-rsc,@cloudflare/vite-plugin)vite.config.tswith VineXT, RSC, Cloudflare, and Sentry Vite pluginsnext.config.tsby removingwithSentryConfig,withMDX,withNextIntlwrappers,output: "standalone", andreactCompileroptionssentry.server.config.tsto import from@sentry/nodesentry.edge.config.ts(VineXT has no edge runtime concept)src/instrumentation.tsto usetypeof window === "undefined"instead ofNEXT_RUNTIMEenv varsrc/instrumentation-client.tsto use@sentry/reactand removed Next.js-specificonRouterTransitionStartexportsrc/app/global-error.tsxandsrc/pages/_error.tsxto use@sentry/reactpackage.jsonscripts to usevinext dev/build/startTest plan
@sentry/nextjsreferences in the codebaseNEXT_RUNTIMEorwithSentryConfigreferencesvinext devstarts successfullyvinext buildcompletes without Sentry-related errorsSummary by CodeRabbit