November 2023 Summaries

The React component-based approach can cause unnecessary re-renders of components when a parent component passes down a callback function to a child component through its props, even if the child component is memoized. This happens because the callback function receives a different value for the prop every time the parent component gets re-rendered, causing React to bypass the memoization and trigger a re-render. To fix this issue, developers can use the `useCallback` hook to prevent the callback from recreating as long as there are no changes in its dependency array. By doing so, they can ensure that the callback keeps the same reference value between re-renders, preventing unnecessary re-renders of the child component and improving the performance of the application. Integrating a tool like Sentry into the app can help identify these issues and provide valuable insights for optimizing React performance.

The Functional Source License (FSL) is a new license developed by Sentry and Codecov to balance user freedom and developer sustainability for Open Source-minded SaaS companies. FSL is an evolution of the Business Source License (BSL), which has two major flaws: a long non-compete time period and too many parameters, making it difficult for compliance departments to approve use of BSL software. The new license streamlines these issues by setting a shorter change date, selecting Apache 2.0 or MIT as the default change license, and defining Permitted Purpose without an additional use grant. FSL aims to provide freedom without harmful free-riding, prioritizing developer sustainability for both companies and the wider Open Source community.

Sentry aims to help developers write better software with ease, regardless of the languages or platforms used. The company has made significant updates to its SDKs and integrations for emerging web development platforms and frameworks like Bun, Deno, Next.js, and Remix. Sentry now supports 90+ languages and runtimes, and 50+ integrations with various tools. The platform is expanding its ecosystem reach with new APIs, making it easy to connect Sentry to any tool. Key updates include support for Bun and Deno, as well as improvements to the Mobile project onboarding flow. Additionally, Sentry has introduced four new integrations: Opsgenie, Discord, Cloudflare Workers, and LaunchDarkly, which enable developers to get notified about critical issues and metric alerts in a manner that makes sense for their team. The platform is also growing its integration support with APIs, making it easy for users to connect Sentry with any tool.

Sentry is now offering its data storage options in both the US and EU regions, allowing developers to choose where their data is hosted based on privacy and data sovereignty concerns. This change enables a seamless user experience for customers who are part of multiple Sentry organizations, which can be located in different regions. To achieve this, Sentry implemented an architecture that optimizes for UX and privacy, using the concept of "silos" to separate globally unique user data from customer-specific event data. The new EU data region is hosted securely in Frankfurt, Germany, and will be available on all Sentry plans, including free developer plans. Developers can join the waitlist for early access and expect a generally available release in December 2023.

Sentry has embarked on an ambitious project to offer true EU data residency for its customers, allowing data to be hosted in Frankfurt, Germany, at no extra cost across all plan tiers, with general availability anticipated by December. This endeavor, which cost over $3 million and involved around 15 people working part-time or full-time over more than 18 months, required significant architectural changes to Sentry's monolithic Python Django application to ensure a seamless user experience across multiple regions. A key focus was maintaining the ability for users to switch between Sentry organizations globally without disrupting workflows, even as customer data is localized. This was achieved by introducing "silos" to separate global user data from region-specific customer data, breaking foreign key dependencies, and implementing Remote Procedure Calls (RPCs) and an event queue system for cross-silo communication. Additionally, Sentry developed a proxy system for third-party integrations to address challenges posed by multi-region architecture, such as OAuth token synchronization across silos. The project involved complex decisions around data replication, cross-region synchronization, and third-party integrations, with plans for further detailed discussions in an upcoming blog series.

Sentry has introduced Rage and Dead Clicks detection as part of its Session Replay product, which identifies problems caused by user interactions with broken elements in an application, such as missing DOM event listeners or incorrect z-indexes. The new feature provides insights into which components cause the most pain for users, making it easier to fix issues. Sentry also improved its User Feedback feature, allowing users to create bug reports and provide feedback on non-error issues, such as permission problems or typos, with a simple integration that can be added to existing Sentry initialization calls.

SDK engineers at Sentry face the challenge of balancing functionality with bundle size, particularly with features like Session Replay that significantly increase the JavaScript SDK's size. Session Replay aids in debugging by capturing user browser activity but necessitates a substantial amount of JavaScript, thus inflating bundle size. To address this, Sentry updated the rrweb package to version 2.0, initially increasing the bundle size, which prompted a concentrated effort to reduce it. Through various strategies such as removing unused code, optimizing tree shaking, and switching to a smaller compression library, they successfully reduced the minified and gzipped bundle size by up to 35% with maximum tree shaking. These efforts included making certain features optional at build time and allowing the hosting of compression workers separately, ultimately saving additional space and providing flexibility for users with strict Content Security Policies.

Over the past year, Sentry has developed its Cron Monitoring feature from a small prototype into a robust component of its Error, Performance, and Reliability monitoring tools, currently in late-stage beta with over 7 million daily check-ins. This feature allows users to validate and receive alerts about the operational status of scheduled jobs, using a check-in system that identifies missed, timed-out, or errored tasks. Initially, check-in ingestion was managed via API endpoints in Sentry's Django application, but the need for scalability and reliability led to the integration of Relay, Sentry's distributed ingestion infrastructure, which supports improved availability and rapid implementation across SDKs. The architecture now utilizes Kafka to maintain a backlog of check-ins and scale processing as needed. To reliably detect missing check-ins, Sentry transitioned from a once-per-minute task in the Celery beat scheduler, which was prone to issues during deployments and message backlogs, to a consumer-driven clock system using stream time. This ensures tasks are dispatched only after all check-ins are processed up to a minute boundary, eliminating false positives in missed check-ins. Synchronizing the clock across multiple Kafka partitions allows for accurate detection and avoids discrepancies due to asynchronous consumer speeds. As the Crons feature continues to expand, Sentry aims to enhance reliability further and address subtle edge cases such as timezone bugs and SDK limitations.

Sentry has announced two new features: Web Vitals and Function Regression Issues, designed to help web, mobile, and backend developers discover and solve performance problems in their apps. Sentry's Performance monitoring product allows developers to cut through the noise by detecting real problems and quickly identifying the exact line of code responsible. The new features provide a unified measurement of page quality into useful metrics like loading performance, interactivity, and visual stability, known as Web Vitals. This helps identify individual key pages that need performance improvements and rank them by opportunity. It also provides essential context about what changed so you can solve the problem with Function Regression Issues. These new features aim to help developers build differentiated products with high-performance bars that people want to use.

The author of this story triggered a preventable application error via a failed call to a third-party API, returning an HTTP 200 status code despite expecting an HTTP 404. This was due to the design of the Twitch API, which returns an empty array in its response even when a user does not exist. The author realized they had written bad code and didn't read the documentation well, but improved their code by adding a check for the length of the data array and sending a message to the chat if a typo occurs. The story highlights the importance of understanding API design, coding defensively around constraints, and using application performance monitoring tools like Sentry to identify gaps in code.

Sentry has improved its support for GraphQL by adding better syntax-highlighted error messages, capturing errors from GraphQL servers with HTTP status 200 OK, and providing out-of-the-box visibility into GraphQL codebases across different languages and platforms. The Python SDK now supports popular GraphQL server libraries and client libraries, allowing developers to easily integrate Sentry with their GraphQL applications. With the new support, Sentry will display breadcrumb trails of GraphQL events leading to the event, extract query variables, and provide performance monitoring for query execution processes.

The Sentry Next.js SDK has a critical security vulnerability that allows malicious actors to forge requests and responses from the application, commonly known as Server-side Request Forgery (SSRF). The vulnerability exists in versions 7.26.0-7.76.0 of the SDK, which are vulnerable when the tunnelRoute option is enabled. A fix for this vulnerability has been released in version 7.77.0. Users are advised to upgrade to this version or remove the tunnelRoute option from their SDK configuration to fix the issue. The Sentry team has investigated and found no evidence that this vulnerability was exploited, but they have implemented measures to mitigate its impact on infrastructure-level platforms like Vercel. Users can check for signs of exploitation by scanning logs for malicious requests with a specific URL query parameter, and they should consider themselves targeted if such requests are found. To protect customers and themselves, users are advised to invalidate and rotate authentication data after fixing the vulnerability.

API Latency and API Response Time are two key metrics affecting user experience of an app. The total client-server communication time is called API Response Time, which consists of latency and processing time. Latency refers to the time taken for data transmission between the client and server. Factors such as network speed, load balancer, data size, server load, API design, and code can affect response time. Monitoring these metrics in production is crucial for maintaining optimal user experience and business profitability.

The company Sentry has released several product updates in October, including improvements to its Ruby SDK, Session Replay, and integrations with Discord and source code management tools like GitHub Enterprise and Bitbucket. The new features aim to help developers fix broken code faster and easier by providing better error tracking, automated test selection, and enhanced integration with popular development tools. Sentry also released updates to its Python GraphQL support, Astro SDK, and Codecov integrations, which include features like automatic check-in tracking for Cron monitoring and intelligent test selection based on coverage data.