feat(tracing): Connect React Native traces with embedded WebViews by antonis · Pull Request #6794 · getsentry/sentry-react-native

antonis · 2026-09-28T11:51:17Z

📢 Type of change

New feature
Bugfix
Enhancement
Refactoring

📜 Description

Adds the ability to inject the React Native SDK's current trace context into a webview.

Usage:

import { sentryWebViewProps } from '@sentry/react-native';

<WebView
  source={{ uri: 'https://example.com' }}
  {...sentryWebViewProps({ allowedHosts: ['example.com'] })}
/>

The sentry-trace meta tag is used to propagate the distributed tracing.

Alternatives considered

Also considered the wrapper component approach but decided to proceed with an implementation using props.

	Props-helper (this PR)	Wrapper component
Dependency on `react-native-webview`	None — returns plain props	Pulls it in / must use our component
Composability	Spreads onto any `<WebView>`, custom wrappers, refs	Must use our component; friction with custom setups
Expo DOM components (`'use dom'`)	✅ Spread into the `dom` prop: `dom={{ ...sentryWebViewProps(...) }}`	❌ `dom` takes a props object, not a component
Encapsulation	Exposes `injectedJavaScriptBeforeContentLoaded` (low-sensitivity, spreadable)	Hides injection internals

💡 Motivation and Context

Closes #6779
Closes #6780
Closes #6781

💚 How did you test it?

Added tests
Manual testing (example)

📝 Checklist

I added tests to verify changes.
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
I updated the docs if needed docs(react-native): Document sentryWebViewProps for connecting WebView traces sentry-docs#19659
I updated the wizard if needed.
All tests passing.
Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
No breaking changes.

🔮 Next steps

Add `sentryWebViewProps({ allowedHosts })` which injects the React Native trace context (`sentry-trace`/`baggage` meta tags, via `injectedJavaScriptBeforeContentLoaded`) into a `react-native-webview`, so the page's `@sentry/browser` continues the same trace on pageload. Host-gated by `allowedHosts` (case-insensitive, subdomain match) so the context never reaches non-allow-listed pages. Pure JS, no native/bridge changes, both architectures. Also adds a sample WebView demo screen and an iOS/Android Maestro E2E. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-09-28T11:51:38Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

feat(tracing): Connect React Native traces with embedded WebViews by antonis in #6794

fix(ios): Find .xcode.env in the debug symbols phase under SwiftPM by alwx in #6911
chore(deps): update React Native to v0.88.0 by github-actions in #6903
chore(deps): bump getsentry/craft from 2.34.1 to 2.35.0 by dependabot in #6906
chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 by dependabot in #6908
chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.33.1 to 2.35.0 by dependabot in #6907
chore(sample): Bump React Native sample to 0.88.0 by antonis in #6910
chore(deps): bump actions/setup-java from 6.0.1 to 6.1.0 by dependabot in #6909
chore(deps): bump the codeql-action group with 3 updates by dependabot in #6905
chore(deps): update Sentry Android Gradle Plugin to v6.24.0 by github-actions in #6902
chore(deps): bump @appium/support from 7.0.6 to 7.2.8 by dependabot in #6897
ci(e2e): Remove app metrics job and performance-tests by antonis in #6896

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-09-28T11:51:57Z

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against d9557a8

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

sentry · 2026-09-28T12:16:19Z

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
Sentry RN	io.sentry.reactnative.sample	8.31.0 (111)	Release

⚙️ sentry-react-native Build Distribution Settings

github-actions · 2026-09-28T12:23:52Z

iOS (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	3837.81 ms	1219.17 ms	-2618.64 ms
Size	5.15 MiB	6.96 MiB	1.81 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`5125c43`+dirty	3846.45 ms	1221.12 ms	-2625.32 ms
`5fe1c6c`+dirty	1220.79 ms	1217.63 ms	-3.16 ms
`5257d80`+dirty	3854.39 ms	1234.28 ms	-2620.11 ms
`0c50e94`+dirty	3863.88 ms	1235.45 ms	-2628.43 ms
`3e3142c`+dirty	3867.38 ms	1232.48 ms	-2634.90 ms
`ae37560`+dirty	3832.10 ms	1219.09 ms	-2613.02 ms
`f170ec3`+dirty	3822.26 ms	1218.33 ms	-2603.93 ms
`1e5d96d`+dirty	3851.45 ms	1212.05 ms	-2639.41 ms
`6177334`+dirty	3834.85 ms	1217.58 ms	-2617.28 ms
`5a010b7`+dirty	3838.85 ms	1214.98 ms	-2623.87 ms

App size

Revision	Plain	With Sentry	Diff
`5125c43`+dirty	5.15 MiB	6.68 MiB	1.53 MiB
`5fe1c6c`+dirty	3.38 MiB	4.77 MiB	1.39 MiB
`5257d80`+dirty	5.15 MiB	6.69 MiB	1.54 MiB
`0c50e94`+dirty	5.15 MiB	6.95 MiB	1.80 MiB
`3e3142c`+dirty	4.98 MiB	6.56 MiB	1.58 MiB
`ae37560`+dirty	5.15 MiB	6.70 MiB	1.54 MiB
`f170ec3`+dirty	5.15 MiB	6.69 MiB	1.53 MiB
`1e5d96d`+dirty	4.98 MiB	6.46 MiB	1.49 MiB
`6177334`+dirty	5.15 MiB	6.68 MiB	1.53 MiB
`5a010b7`+dirty	5.15 MiB	6.69 MiB	1.54 MiB

Previous results on branch: feat/webview-trace-connection

Startup times

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	3859.26 ms	1234.82 ms	-2624.44 ms
`cae40ac`+dirty	3867.38 ms	1221.07 ms	-2646.31 ms
`38369a5`+dirty	3865.45 ms	1234.82 ms	-2630.63 ms
`3f38932`+dirty	3848.33 ms	1207.79 ms	-2640.54 ms
`42ab8cd`+dirty	3841.44 ms	1217.98 ms	-2623.46 ms

App size

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	5.15 MiB	6.93 MiB	1.78 MiB
`cae40ac`+dirty	5.15 MiB	6.94 MiB	1.79 MiB
`38369a5`+dirty	5.15 MiB	6.93 MiB	1.78 MiB
`3f38932`+dirty	5.15 MiB	6.93 MiB	1.78 MiB
`42ab8cd`+dirty	5.15 MiB	6.95 MiB	1.80 MiB

github-actions · 2026-09-28T12:27:40Z

Android (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	442.87 ms	466.57 ms	23.71 ms
Size	50.56 MiB	56.62 MiB	6.06 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`23598c3`+dirty	414.12 ms	426.24 ms	12.12 ms
`bc8f61e`+dirty	442.98 ms	506.56 ms	63.58 ms
`0a9e622`+dirty	420.73 ms	464.83 ms	44.10 ms
`bf168a4`+dirty	418.21 ms	489.74 ms	71.53 ms
`b0d3373`+dirty	557.66 ms	579.42 ms	21.76 ms
`be120d6`+dirty	536.61 ms	552.02 ms	15.41 ms
`57e0069`+dirty	413.82 ms	453.47 ms	39.65 ms
`b9bebee`+dirty	438.86 ms	452.21 ms	13.35 ms
`0d9949d`+dirty	403.57 ms	437.00 ms	33.43 ms
`580fb5c`+dirty	436.34 ms	471.63 ms	35.28 ms

App size

Revision	Plain	With Sentry	Diff
`23598c3`+dirty	43.75 MiB	48.16 MiB	4.41 MiB
`bc8f61e`+dirty	49.74 MiB	55.09 MiB	5.35 MiB
`0a9e622`+dirty	49.74 MiB	55.09 MiB	5.34 MiB
`bf168a4`+dirty	49.74 MiB	55.09 MiB	5.35 MiB
`b0d3373`+dirty	48.30 MiB	53.58 MiB	5.28 MiB
`be120d6`+dirty	49.74 MiB	55.36 MiB	5.62 MiB
`57e0069`+dirty	49.74 MiB	54.85 MiB	5.11 MiB
`b9bebee`+dirty	48.30 MiB	53.58 MiB	5.28 MiB
`0d9949d`+dirty	43.75 MiB	48.13 MiB	4.37 MiB
`580fb5c`+dirty	49.74 MiB	54.79 MiB	5.05 MiB

Previous results on branch: feat/webview-trace-connection

Startup times

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	424.09 ms	468.34 ms	44.25 ms
`cae40ac`+dirty	453.83 ms	511.20 ms	57.37 ms
`3f38932`+dirty	478.31 ms	537.14 ms	58.83 ms
`38369a5`+dirty	460.42 ms	490.15 ms	29.73 ms

App size

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	50.56 MiB	56.51 MiB	5.95 MiB
`cae40ac`+dirty	50.56 MiB	56.59 MiB	6.03 MiB
`3f38932`+dirty	50.56 MiB	56.51 MiB	5.95 MiB
`38369a5`+dirty	50.56 MiB	56.51 MiB	5.95 MiB

…roid `react-native-webview` only executes `injectedJavaScriptBeforeContentLoaded` on Android when an `onMessage` handler is set. `sentryWebViewProps` now returns a no-op `onMessage` so the trace-context injection also runs on Android for the documented usage; users who need their own handler spread the props first and set `onMessage` after. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- Poll for the injected meta tag in the sample page: on Android the injected script runs shortly after the page's initial script, so an immediate read misses it (real apps' @sentry/browser read on pageload init, later). - Spread sentryWebViewProps before the sample's own onMessage so the sample's handler wins now that the helper returns one. - Add Android status-bar top padding to the Playground screen so the first button is not under the status bar. - Increase the button wait to 30s for slower Android cold starts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

antonis · 2026-09-28T12:35:41Z

  },
+  // RN's SafeAreaView is a no-op on Android, so clear the status bar explicitly
+  // to keep the first button tappable (and out from under the status bar).
+  scrollContent: {


Note: this change is unrelated to the core pr. It just fixes a preexisting issue were the first button of the playground tab was hidden below the status bar/camera.

cursor

Stale Bugbot comment from a previous run.

github-actions · 2026-09-28T12:58:22Z

iOS (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	3872.88 ms	1245.69 ms	-2627.18 ms
Size	5.15 MiB	6.96 MiB	1.81 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`7436d0f`+dirty	3861.51 ms	1231.07 ms	-2630.44 ms
`c2e182c`+dirty	3841.76 ms	1220.76 ms	-2621.01 ms
`0c50e94`+dirty	3856.18 ms	1238.30 ms	-2617.87 ms
`61cc206`+dirty	3822.60 ms	1206.17 ms	-2616.43 ms
`c151573`+dirty	3835.64 ms	1216.10 ms	-2619.53 ms
`2d5d963`+dirty	3858.87 ms	1225.92 ms	-2632.95 ms
`84cba31`+dirty	3830.40 ms	1204.44 ms	-2625.96 ms
`4e0b819`+dirty	3828.96 ms	1205.64 ms	-2623.32 ms
`68ae91b`+dirty	3836.36 ms	1222.04 ms	-2614.32 ms
`ed70c7f`+dirty	3869.51 ms	1240.25 ms	-2629.26 ms

App size

Revision	Plain	With Sentry	Diff
`7436d0f`+dirty	5.15 MiB	6.70 MiB	1.54 MiB
`c2e182c`+dirty	4.98 MiB	6.51 MiB	1.53 MiB
`0c50e94`+dirty	5.15 MiB	6.95 MiB	1.80 MiB
`61cc206`+dirty	4.98 MiB	6.55 MiB	1.57 MiB
`c151573`+dirty	5.15 MiB	6.68 MiB	1.53 MiB
`2d5d963`+dirty	5.15 MiB	6.88 MiB	1.73 MiB
`84cba31`+dirty	4.98 MiB	6.55 MiB	1.57 MiB
`4e0b819`+dirty	4.98 MiB	6.46 MiB	1.49 MiB
`68ae91b`+dirty	4.98 MiB	6.46 MiB	1.48 MiB
`ed70c7f`+dirty	5.15 MiB	6.95 MiB	1.80 MiB

Previous results on branch: feat/webview-trace-connection

Startup times

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	3836.43 ms	1220.55 ms	-2615.87 ms
`cae40ac`+dirty	3870.87 ms	1227.49 ms	-2643.38 ms
`38369a5`+dirty	3859.80 ms	1231.95 ms	-2627.84 ms
`3f38932`+dirty	3850.69 ms	1221.91 ms	-2628.78 ms
`42ab8cd`+dirty	3868.29 ms	1253.61 ms	-2614.67 ms

App size

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	5.15 MiB	6.93 MiB	1.78 MiB
`cae40ac`+dirty	5.15 MiB	6.94 MiB	1.79 MiB
`38369a5`+dirty	5.15 MiB	6.93 MiB	1.78 MiB
`3f38932`+dirty	5.15 MiB	6.93 MiB	1.78 MiB
`42ab8cd`+dirty	5.15 MiB	6.95 MiB	1.80 MiB

github-actions · 2026-09-28T13:07:37Z

Android (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	502.56 ms	553.02 ms	50.46 ms
Size	50.56 MiB	56.62 MiB	6.06 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`038a6d7`+dirty	499.02 ms	527.68 ms	28.66 ms
`27d9693`+dirty	438.63 ms	514.08 ms	75.46 ms
`3d377b5`+dirty	425.38 ms	440.67 ms	15.30 ms
`0668149`+dirty	410.52 ms	454.12 ms	43.60 ms
`580fb5c`+dirty	515.72 ms	585.38 ms	69.66 ms
`0bd8916`+dirty	400.15 ms	442.72 ms	42.57 ms
`44c8b3f`+dirty	492.13 ms	563.47 ms	71.34 ms
`822d35b`+dirty	472.69 ms	561.24 ms	88.56 ms
`7d6fd3a`+dirty	435.06 ms	458.78 ms	23.72 ms
`7ff4d0f`+dirty	403.38 ms	427.06 ms	23.68 ms

App size

Revision	Plain	With Sentry	Diff
`038a6d7`+dirty	48.30 MiB	53.60 MiB	5.30 MiB
`27d9693`+dirty	49.74 MiB	55.09 MiB	5.34 MiB
`3d377b5`+dirty	43.94 MiB	49.00 MiB	5.06 MiB
`0668149`+dirty	50.56 MiB	56.59 MiB	6.03 MiB
`580fb5c`+dirty	49.74 MiB	54.79 MiB	5.05 MiB
`0bd8916`+dirty	48.30 MiB	53.57 MiB	5.26 MiB
`44c8b3f`+dirty	48.30 MiB	53.46 MiB	5.15 MiB
`822d35b`+dirty	49.74 MiB	54.84 MiB	5.10 MiB
`7d6fd3a`+dirty	43.94 MiB	49.00 MiB	5.06 MiB
`7ff4d0f`+dirty	48.30 MiB	53.60 MiB	5.30 MiB

Previous results on branch: feat/webview-trace-connection

Startup times

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	478.42 ms	535.94 ms	57.52 ms
`cae40ac`+dirty	468.24 ms	523.41 ms	55.17 ms
`3f38932`+dirty	506.24 ms	560.89 ms	54.65 ms
`38369a5`+dirty	453.41 ms	480.22 ms	26.81 ms

App size

Revision	Plain	With Sentry	Diff
`38369a5`+dirty	50.56 MiB	56.51 MiB	5.95 MiB
`cae40ac`+dirty	50.56 MiB	56.59 MiB	6.03 MiB
`3f38932`+dirty	50.56 MiB	56.51 MiB	5.95 MiB
`38369a5`+dirty	50.56 MiB	56.51 MiB	5.95 MiB

Skip injection if a `sentry-trace` meta tag already exists in the page, so the trace context is never duplicated when more than one path could inject it (e.g. a future native injector alongside the RN helper, or the script running twice). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

philprime · 2026-09-28T14:32:02Z

+
+// @public
+export function sentryWebViewProps(options: SentryWebViewOptions): {
+    injectedJavaScriptBeforeContentLoaded: string;


m: Thinking forward this could potentially grow into multiple events being supported. Maybe it makes sense to prepare and use a structured approach, e.g.:

Suggested change

injectedJavaScriptBeforeContentLoaded: string;

injectedCustomScripts: {

beforeContentLoaded: string

}

Thank you @philprime 🙇 I surfaced the underlying component api for this one but I'll consider future proofing it.

philprime · 2026-09-28T14:34:01Z

+ * ```
+ */
+export function sentryWebViewProps(options: SentryWebViewOptions): {
+  injectedJavaScriptBeforeContentLoaded: string;


m: See my comment above w.r.t. future-proofing

philprime · 2026-09-28T14:35:49Z

+  const sentryTraceLiteral = JSON.stringify(sentryTrace);
+  const baggageLiteral = JSON.stringify(traceData.baggage ?? null);
+
+  return `(function(){try{


m: Is this safe for code injection attacks? Just thinking if any of the values are from external systems/cookies etc. and could be abused by an attacker.

cc @NinjaLikesCheez as you are a security expert

We should absolutely engage the security team as early as possible in the design of this feature - here be dragons.

Good point 👍 Marking as blocked to get more feedback on the security side of the changes.

Check RN-796 for a link to the security review

# Conflicts: # CHANGELOG.md

The root span name is propagated to the WebView via the `baggage` meta tag as `sentry-transaction`. It is free-form text that can carry user data (for example a parameterized URL), so remove it before the trace context leaves the app. Every other Dynamic Sampling Context entry (release, environment, sample rate, sample rand, sampled) and any third-party baggage entries are preserved, so dynamic sampling stays consistent across the connected traces. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Feed hostile values (quote/backtick/template-literal, </script>, backslash, newline/CR, U+2028/U+2029 line separators, null byte, statement + comment) and 200 random dangerous-charset strings through every value embedded in the injected script — the sentry-trace value, a baggage entry value, and an allowedHosts entry. Assert a window canary never executes and the values are only ever read back as inert meta content, proving JSON.stringify is the escaping boundary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

`sentryWebViewProps` returns a single `injectedJavaScriptBeforeContentLoaded` string. Spreading the props and then setting your own value after the spread silently replaces Sentry's injection and disables trace linking (and setting it before drops yours). Unlike `onMessage` — where any handler keeps the Android injection running — this prop cannot be safely overridden, so document that it must be concatenated with the returned string, with an example. Addresses Warden review finding 9C6-FDS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

…nnection

The demo compared the WebView's injected-trace readback against a live `getTraceData()` re-read on every render. Once the navigation span ends the active `sentry-trace` keeps the same trace_id but gets a new span_id, so the comparison could flip to "not connected" even when the page received the injected trace correctly — making the status and its Maestro assertion a race against the navigation span's idle timeout. Capture the trace (`useState` initializer) and the injection props (`useMemo`) once at mount, so the injected value and the comparison baseline are the same mount-time snapshot. Addresses the Warden and Bugbot review findings on WebviewScreen. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cursor

Stale Bugbot comment from a previous run.

alwx · 2026-10-19T11:31:08Z

+
+  if (!sentryTrace) {
+    debug.log(`[${WEBVIEW_LABEL}] No active trace found; skipping WebView trace injection.`);
+    return '';


getTraceData() returns {} only when the SDK is disabled or there is no client so I think the message here (the one added with debug.log) is misleading.

Good call 👍 Updated with 746da1a

alwx · 2026-10-19T11:36:33Z

+var allowed=${allowedHostsLiteral};
+var host=(window.location&&window.location.hostname||'').toLowerCase();
+if(!host)return;
+if(!allowed.some(function(h){return host===h||host.slice(-(h.length+1))==='.'+h;}))return;


Q: allowedHosts never get normalized, right? Because I see the comparison is pretty strict (host===h) and I guess the normalization of allowedHosts needs to be done for this to work properly.

Good idea to enhance this. Updated with 746da1a

alwx · 2026-10-19T11:37:28Z

+  // gated on its own host rather than the one the WebView was opened with. The
+  // script is idempotent — if a `sentry-trace` meta already exists (e.g. injected
+  // by another path), it does nothing, so the trace context is never duplicated.
+  const allowedHostsLiteral = JSON.stringify((allowedHosts ?? []).map(host => host.toLowerCase()));


allowedHosts ?? [] seems to be a fallback for a required field. Could the field be made optional instead?

Updated with 746da1a

alwx · 2026-10-19T11:39:36Z

 export { graphqlIntegration } from './graphql';
 export { supabaseIntegration } from './supabase';
 export { deeplinkIntegration } from './deeplink';
+export { sentryWebViewProps } from './webview';


ok, I'm a bit confused — sentryWebViewProps is not really an integration, right? Why is it then exported from integrations/exports.ts and lives under integrations?

Good point 👍 Moved with 746da1a

alwx · 2026-10-19T11:41:11Z

+        let payload = '';
+        for (let c = 0; c < length; c++) {
+          payload += CHARS[Math.floor(Math.random() * CHARS.length)];
+        }


a small thing: Math.random() makes it non-deterministic. Could it be used with a seed instead?

Updated with 746da1a

…nnection

@alwx

- Move the webview helper out of `integrations/` (it is not an integration) to `src/js/tracing/webview.ts` and re-export it via the tracing barrel. The public API is unchanged. - Normalize `allowedHosts` entries (trim, strip scheme/path/port/trailing dot, lowercase) so bare-hostname matching is robust. - Replace the `allowedHosts ?? []` fallback on the required field with an explicit validation guard that degrades to a no-op with a warning instead of throwing during render. - Reword the no-trace debug log to reflect the real cause (the SDK being disabled or not initialized, not "no active trace"). - Make the fuzz test deterministic with a seeded PRNG and add tests for the normalization and empty-allowedHosts cases. Addresses review feedback from @alwx. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CodeQL flagged `/[/?#].*$/` in `normalizeHost` as a polynomial regular expression (backtracking on inputs with many `#`). Replace it with a `search` + `slice` that strips everything from the first path/query/fragment separator without a `.*` to backtrack on. Normalization output is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b2eb4fa. Configure here.}

The JSDoc claimed the trace tags are written "before @sentry/browser initializes", which only holds on iOS. On Android `react-native-webview` injects asynchronously as the page starts, so the tags can land after the page's first synchronous <head> scripts. Reword to describe the real timing: a @sentry/browser loaded the usual way (script tag, bundle, or async/deferred init) reads the tags once present and continues the trace; only a synchronous inline init at the very top of <head> may miss them on Android and start a new trace (which fails safe — the WebView just gets its own trace). Verified on a Pixel 8 emulator: real @sentry/browser continued the trace 5/5 runs; a probe confirmed the meta is not present at the first synchronous head script. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…nnection # Conflicts: # CHANGELOG.md

`normalizeHost` stripped a trailing `:<digits>` unconditionally, mistaking an unbracketed IPv6 hextet for a port (`::1` -> `:`, `2001:db8::1` -> `2001:db8:`), so an IPv6-hosted page could never match and the trace was skipped. Browsers bracket IPv6 in `location.hostname` (e.g. `[::1]`), so: keep a bracketed host up to the closing bracket (dropping any `:port` after it), wrap an unbracketed IPv6 literal (more than one colon) in brackets so it still matches, and keep normal `:port` stripping for hostnames and IPv4. Still no `.*` regex (CodeQL-safe). Addresses Warden review finding on allowedHosts normalization. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

alwx

Looks good.

antonis and others added 2 commits September 28, 2026 13:50

docs(changelog): Link WebView trace connection entry to #6794

02a8c01

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

antonis added the ready-to-merge Triggers the full CI test suite label Sep 28, 2026

docs(changelog): Add sentryWebViewProps usage example

f6fe535

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sentry Bot reviewed Sep 28, 2026

View reviewed changes

Comment thread packages/core/src/js/tracing/webview.ts

cursor Bot reviewed Sep 28, 2026

View reviewed changes

antonis and others added 2 commits September 28, 2026 14:32

antonis commented Sep 28, 2026

View reviewed changes

cursor Bot reviewed Sep 28, 2026

View reviewed changes

antonis mentioned this pull request Sep 28, 2026

docs(react-native): Document sentryWebViewProps for connecting WebView traces getsentry/sentry-docs#19659

Open

1 of 4 tasks

This was linked to issues Sep 28, 2026

feat(tracing): Inject RN trace context into WebViews for connected traces #6780

Open

test(e2e): Verify RN↔WebView connected trace in sample app #6781

Open

cursor Bot reviewed Sep 28, 2026

View reviewed changes

sentry-warden Bot reviewed Sep 28, 2026

View reviewed changes

Comment thread packages/core/src/js/integrations/webview.ts Outdated

antonis marked this pull request as ready for review September 28, 2026 14:08

antonis requested review from a team, alwx and lucas-zimerman as code owners September 28, 2026 14:08

philprime reviewed Sep 28, 2026

View reviewed changes

antonis added the Blocked label Sep 28, 2026

antonis marked this pull request as draft September 29, 2026 11:50

antonis and others added 3 commits October 14, 2026 18:05

Merge branch 'main' into feat/webview-trace-connection

531d0cb

# Conflicts: # CHANGELOG.md

antonis force-pushed the feat/webview-trace-connection branch from 51dc667 to 87043de Compare October 14, 2026 16:35

sentry-warden Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread packages/core/src/js/tracing/webview.ts

antonis and others added 2 commits October 14, 2026 19:33

test(sample): Inject webview configuration for e2e test

9f89d96

cursor Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread samples/react-native/src/Screens/WebviewScreen.tsx

Merge branch 'main' into feat/webview-trace-connection

8927fb9

antonis added ready-to-merge Triggers the full CI test suite and removed ready-to-merge Triggers the full CI test suite labels Oct 15, 2026

antonis mentioned this pull request Oct 15, 2026

ci(e2e): Remove app metrics job and performance-tests #6896

Merged

7 of 11 tasks

antonis and others added 2 commits October 16, 2026 15:58

Merge remote-tracking branch 'origin/main' into feat/webview-trace-co…

02d47b4

…nnection

cursor Bot reviewed Oct 16, 2026

View reviewed changes

antonis marked this pull request as ready for review October 16, 2026 14:48

antonis removed the Blocked label Oct 16, 2026

antonis requested a review from philprime October 19, 2026 09:32

alwx requested changes Oct 19, 2026

View reviewed changes

antonis and others added 2 commits October 19, 2026 13:51

Merge remote-tracking branch 'origin/main' into feat/webview-trace-co…

4dbffe6

…nnection

github-advanced-security Bot found potential problems Oct 19, 2026

View reviewed changes

Comment thread packages/core/src/js/tracing/webview.ts Fixed

antonis and others added 2 commits October 19, 2026 14:08

Merge branch 'main' into feat/webview-trace-connection

b2eb4fa

cursor Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread packages/core/src/js/tracing/webview.ts Outdated

antonis and others added 3 commits October 19, 2026 14:49

Merge remote-tracking branch 'origin/main' into feat/webview-trace-co…

1266495

…nnection # Conflicts: # CHANGELOG.md

antonis requested a review from alwx October 19, 2026 13:44

alwx approved these changes Oct 19, 2026

View reviewed changes

-    injectedJavaScriptBeforeContentLoaded: string;
+    injectedCustomScripts: {
+        beforeContentLoaded: string
+    }

Conversation

antonis commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📢 Type of change

📜 Description

Alternatives considered

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sentry Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📲 Install Builds

Android

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

iOS (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: feat/webview-trace-connection

Startup times

App size

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: feat/webview-trace-connection

Startup times

App size

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

iOS (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: feat/webview-trace-connection

Startup times

App size

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: feat/webview-trace-connection

Startup times

App size

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

antonis commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

sentry Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading