Changelog

Oct 27, 2026: Tested recipes for Node.js servers, Bun and Supabase Edge Functions#

SDK 0.6.1 · docs

• New guides for Bun and Supabase Edge Functions, and a VPS section in the Node.js guide. Each one is tested as published on a real node: on Supabase's Edge Runtime, an error thrown by a handler, an error you handle, a { data, error } result and an upstream timeout each arrive as their own issue, sent before the function answers.

• @belvador/core/sentry is a stable entry for apps on the official Sentry SDKs: Belvador's own scrubbing as beforeSend / beforeBreadcrumb, and captureResultWith(Sentry) for database errors that do not throw. The Node.js setup now uses it instead of a copied scrubbing function.

• With @belvador/spool, errors made while your node was unreachable arrived after the process was killed with SIGKILL and after an out-of-memory crash (Node.js), and after SIGKILL on Bun.

• Each guide has a prompt for AI coding agents with the same files.

Oct 27, 2026: Errors that survive a lost connection, and database errors that do not throw#

SDK 0.6.0 · @belvador/spool 0.6.0

• init({ offline: true }) in the browser keeps errors that fail on the network in IndexedDB (at most 50, for 72 hours) and sends them when the page is back online or on the next load. The queue is a separate 1.8 KB file, loaded only when you turn it on.

• New package @belvador/spool for Node.js, Bun and Deno servers on the official Sentry SDK: errors wait on disk while your node is unreachable and are sent once it answers, also by the next process. Tested by killing the process with SIGKILL: 200 of 200 errors arrived, none twice.

• captureResult() reports the error of Supabase, PostgREST and other { data, error } clients as one event typed by its Postgres code (db.permission_denied, db.query_canceled, …), grouped by type and operation. The SQL, details and hint are never sent.

• privacyPolicy() applies the project's privacy rules in your app too, and preview: true prints exactly what would be sent without sending it.

• Retries now wait a random time below 1, 2, 4, then 8 seconds, so many apps that lost the connection together do not all come back in the same second.

Oct 26, 2026: Report only a job's final failure#

SDK 0.5.3

• withMonitor takes reportRetries: false: an attempt that will be retried still sends its check-in (shown as Will retry) but no issue event; the final failed attempt is reported as before. By default every failed attempt is still reported, so the run shows what each one hit.

• Errors reported from withMonitor carry the attempt number in their monitor context.

• Why: in our lab, ten payment jobs that each failed three times sent 30 events for 10 failures, and a job that recovered on its third try still left 2 events. The Sentry Node SDK sends every attempt too; its Dedupe integration, on by default only in the browser SDK, did not help once jobs ran side by side.

Oct 26, 2026: Ping recipes that cannot stop your job#

docs

• Every curl recipe for ping URLs and HTTP check-ins now ends with || true. Before, if the ping URL answered with an error after its retries, a script using set -e — and every GitHub Actions step, which runs with bash -e — stopped right there; in our lab the job never ran. Copy the recipe again from the monitor page or the docs.

• The check-in recipes also gained the 10-second timeout and retries the ping recipes already had, so an unreachable URL can no longer hang a job.

Oct 26, 2026: More secrets masked in error messages#

SDK 0.5.2 · node 0.1.31

• The SDKs and your node now mask keys that their provider prefix gives away — GitHub (ghp_, github_pat_), GitLab, OpenAI and Anthropic (sk-proj-, sk-ant-), AWS access key IDs (AKIA…), Slack (xoxb-), Google API keys, Stripe webhook secrets, npm, Supabase secret keys and Belvador ingest keys — wherever they appear in text.

• The secret part of Slack and Discord webhook URLs and Telegram bot URLs is masked; the host stays readable.

• Authorization: token … and other schemes written into a message, such as a failed curl command line, are masked like Bearer already was.

• In our lab, 14 real Node.js errors carried a synthetic secret; before this release 5 of the 15 secrets were still readable after both filters, now none are.

Oct 26, 2026: Loader errors in TanStack Start apps, with the server stack#

SDK 0.5.1

• With withBelvadorRouter({ routeTree, ... }), an error thrown in a route loader while the page renders on the server is reported from the server, with the server stack — before, it arrived from the browser with a stack that only pointed at the page. In our production-build lab: 3 of 3 SSR loader errors arrived once, with the loader's function name and file.

• Each error is reported once: the server passes the browser a short hash of what it already sent, never the message. Without the server half, the browser still reports it, as before.

• Your own onError, dehydrate and hydrate keep working and see only their own data.

Oct 26, 2026: Route errors in TanStack Start apps without an error page#

SDK 0.5.0

• @belvador/tanstack-start adds withBelvadorRouter: wrap the options you pass to createRouter and route errors are reported even when your app has no error component. Before, TanStack Router skipped the report in that case; in our lab, 0 of 3 route crashes arrived, now 3 of 3.

• Your own defaultOnCatch and defaultErrorComponent keep working; belvadorOnCatch is still exported.

Oct 26, 2026: Stronger data filtering and background errors in Workers#

SDK 0.4.1 · node 0.1.30

• Your node and the SDKs now also mask percent-encoded email addresses (jane%40example.com) and public IPv4 addresses inside error messages and logs. Private addresses such as 10.0.3.17 stay readable.

• Your node removes the whole user name and password from URLs like https://user:pass@host, not only the password.

• @belvador/cloudflare reports a rejected ctx.waitUntil promise as an unhandled error; Cloudflare still receives the same rejection.

• The React and TanStack Start packages on npm carry the corrected setup: Belvador starts before your app is imported, so an error while the app loads is reported.

Oct 25, 2026: Faster sealed buffering and public product pages#

node 0.1.29

• Events buffered at the edge while a node is offline are sealed with the runtime's built-in X25519, about five times faster than before.

• If the edge queue fails, the event is written to a sealed R2 fallback instead of being refused.

• Python 3.12 and the Java Sentry bridge passed OpenTelemetry certification runs.

• New pages: pricing, comparisons with Sentry, self-hosted Sentry, GlitchTip and Bugsink, framework guides, benchmarks and two free tools.

Oct 24, 2026: OpenTelemetry traces and logs, uptime checks, SLOs#

node 0.1.26

• Traces and logs over OTLP/HTTP, stored on your node, with a waterfall view, log search and links from issues.

• Uptime checks from Europe, the US and Asia-Pacific, decided by majority, with TLS expiry warnings.

• SLOs on uptime checks, monitors, ping URLs or spans, with fast- and slow-burn alerts and OpenSLO import and export.

Oct 23, 2026: Ping URL monitors and the OpenTelemetry bridge#

SDK 0.4.0 · node 0.1.25

• Ping URL monitors for any cron job or timer: one secret URL, with start, fail, exit code and output signals. They keep alerting while your node is down.

• Signed webhooks for alerts, in the Standard Webhooks format.

• @belvador/* 0.4.0: errors carry the active OpenTelemetry span when your app already uses the OpenTelemetry API.

Oct 20, 2026: Cron monitors and a node that survives power loss#

SDK 0.3.0 · node 0.1.23

• Check-in monitors for scheduled jobs and workers, with withMonitor() in the @belvador/* packages and Sentry SDK check-ins.

• Optional trace headers so errors from the browser and the server share a trace id.

• Node 0.1.23 stored 24,001 of 24,001 events exactly once across three power cuts (benchmarks).

Oct 19, 2026: Connection checks and the docs#

SDK 0.2.0

• verifyIntegration() proves from production that browser and server errors reach the right project, per environment.

• Connection problems (a revoked key still in use, a blocked origin) open on the project and can alert.

• Documentation in English and Vietnamese, with llms.txt and a Markdown copy of every page.

Oct 17, 2026: First SDK packages#

SDK 0.1.0

• @belvador/browser, @belvador/react, @belvador/cloudflare and @belvador/tanstack-start on npm, MIT, built on Sentry's JavaScript engine.