feat(core)!: Remove sendDefaultPii in favor of dataCollection (#22918)

Removes all occurrences of `sendDefaultPii` and also updates the
migration docs.

Closes #22708

---------

Co-authored-by: Charly Gomez <charly.gomez1310@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 3 people

.agents/skills/add-ai-integration/SKILL.md

@@ -95,7 +95,7 @@ Reference: `packages/node/src/integrations/tracing/langchain/`
 
 ## Key Rules
 
-1. Respect `sendDefaultPii` for `recordInputs`/`recordOutputs`
+1. Respect `dataCollection.genAI` for recording input and output messages
 2. Set `SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN = 'auto.ai.{provider}'` (alphanumerics, `_`, `.` only)
 3. Truncate large data with helper functions from `utils.ts`
 4. `gen_ai.invoke_agent` for parent ops, `gen_ai.chat` for child ops

MIGRATION.md

@@ -96,64 +96,64 @@ For most users, day-to-day tracing is **unchanged**.
 
 Affected SDKs: All SDKs.
 
-The `sendDefaultPii` option was **removed** and replaced by a more granular `dataCollection` option that controls each category of collected data individually.
+> **Heads up — this is a behavior change, not just a renamed option.**
+> In v10, leaving `sendDefaultPii` unset behaved like `sendDefaultPii: false` (restrictive).
+> In v11, leaving `dataCollection` unset collects the categories below **by default**.
+> Review this before upgrading if you'd rather not collect HTTP request data, database queries, or GenAI inputs/outputs.
 
-The **default behaviour is now more permissive**. In v10, with neither `sendDefaultPii` nor `dataCollection` set, the SDK behaved like `sendDefaultPii: false`. In v11, the `dataCollection` defaults apply out of the box:
+We've replaced `sendDefaultPii` with `dataCollection`, which controls each category of collected data individually. The default is now more permissive than in v10.
 
-| Category              | v10 default (no `sendDefaultPii`) | v11 default          |
-| --------------------- | --------------------------------- | -------------------- |
-| `userInfo`            | `false`                           | `true`               |
-| `cookies`             | sensitive keys denied             | `true`               |
-| `httpHeaders`         | sensitive keys denied             | request + response   |
-| `httpBodies`          | none (`[]`)                       | all request/response |
-| `urlQueryParams`      | sensitive keys denied             | `true`               |
-| `genAI`               | inputs/outputs off                | inputs + outputs on  |
-| `stackFrameVariables` | `true`                            | `true`               |
-| `frameContextLines`   | `5`                               | `5`                  |
+| Category              | v10 default (`sendDefaultPii` off) | v11 default          |
+| --------------------- | ---------------------------------- | -------------------- |
+| `userInfo`            | `false`                            | `true`               |
+| `cookies`             | not collected                      | `true`               |
+| `httpHeaders`         | request + response, PII scrubbed   | request + response   |
+| `httpBodies`          | not collected (size only)          | all request/response |
+| `urlQueryParams`      | `true`                             | `true`               |
+| `genAI`               | inputs + outputs not collected     | inputs + outputs     |
+| `databaseQueryData`   | `false`                            | `true`               |
+| `stackFrameVariables` | `true`                             | `true`               |
+| `frameContextLines`   | `7`                                | `5`                  |
 
-> Sensitive values (keys, tokens, auth headers, etc.) are always filtered out regardless of these settings.
+> Sentry's built-in sensitive-data filtering still applies. Review your data-scrubbing config for categories that may contain sensitive values — especially request/response bodies.
 
-Migration:
+#### If you previously set `sendDefaultPii: true`
+
+The v11 default matches this, so just remove the option:
 
 ```js
-// before (v10) — collect the default set of PII
-Sentry.init({
-  sendDefaultPii: true,
-});
+// v10
+Sentry.init({ sendDefaultPii: true });
 
-// after (v11) — this is now the default; you can remove the option entirely,
-// or opt into specific categories explicitly:
-Sentry.init({
-  dataCollection: {
-    userInfo: true,
-    cookies: true,
-    httpHeaders: { request: true, response: true },
-    urlQueryParams: true,
-    genAI: { inputs: true, outputs: true },
-  },
-});
+// v11 — same behavior is now the default
+Sentry.init({});
 ```
 
-If you previously relied on the restrictive default (`sendDefaultPii: false` or unset) and want to
-keep collecting as little data as possible, you now need to opt out explicitly:
+#### If you want to keep the v10 default behavior
+
+Set the baseline explicitly. **Don't leave `dataCollection` unset** — that now enables broader collection.
 
 ```js
-// after (v11) — restrict data collection to the v10-like minimum
+// v11 — preserves the v10 default
 Sentry.init({
   dataCollection: {
     userInfo: false,
     cookies: false,
-    httpHeaders: { request: false, response: false },
+    httpHeaders: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
     httpBodies: [],
-    urlQueryParams: false,
+    urlQueryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
     genAI: { inputs: false, outputs: false },
+    databaseQueryData: false,
+    graphQL: { document: false, variables: false },
   },
 });
 ```
 
 Each key-value field (`cookies`, `urlQueryParams`, `httpHeaders.request`, `httpHeaders.response`) accepts
 `true`, `false`, `{ allow: string[] }`, or `{ deny: string[] }` for fine-grained control.
 
+See the [`dataCollection` docs](https://docs.sentry.io/platforms/javascript/configuration/options/#dataCollection) for the full option list.
+
 #### RequestData
 
 The `requestDataIntegration`'s `include` options remain an integration-level override. An explicit `false`

dev-packages/e2e-tests/test-applications/nextjs-16-streaming-cacheComponents/instrumentation-client.ts

@@ -5,7 +5,6 @@ Sentry.init({
   dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
   tunnel: `http://localhost:3031/`, // proxy server
   tracesSampleRate: 1.0,
-  sendDefaultPii: true,
   integrations: [Sentry.spanStreamingIntegration()],
 });
 

dev-packages/e2e-tests/test-applications/nextjs-16-streaming-cacheComponents/sentry.edge.config.ts

@@ -5,7 +5,6 @@ Sentry.init({
   dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
   tunnel: `http://localhost:3031/`, // proxy server
   tracesSampleRate: 1.0,
-  sendDefaultPii: true,
   traceLifecycle: 'stream',
   integrations: [Sentry.spanStreamingIntegration()],
 });

dev-packages/e2e-tests/test-applications/nextjs-16-streaming-cacheComponents/sentry.server.config.ts

@@ -5,7 +5,6 @@ Sentry.init({
   dsn: process.env.NEXT_PUBLIC_E2E_TEST_DSN,
   tunnel: `http://localhost:3031/`, // proxy server
   tracesSampleRate: 1.0,
-  sendDefaultPii: true,
   traceLifecycle: 'stream',
   integrations: [Sentry.vercelAIIntegration(), Sentry.spanStreamingIntegration()],
 });

dev-packages/node-integration-tests/suites/tracing/requestData-streamed/instrument.mjs

@@ -7,6 +7,4 @@ Sentry.init({
   tracesSampleRate: 1.0,
   transport: loggingTransport,
   traceLifecycle: 'stream',
-  // todo(v11): bridge-regression counterpart to instrument-with-datacollection.mjs; remove when sendDefaultPii is dropped in v11
-  sendDefaultPii: true,
 });

packages/astro/src/server/middleware.ts

@@ -175,6 +175,10 @@ async function instrumentRequestStartHttpServerSpan(
   }
 
   const request = ctx.request;
+  const client = getClient();
+  if (!client) {
+    return next();
+  }
 
   // Note: We guard outside of this function call that the request is dynamic
   // accessing headers on a static route would throw
@@ -212,10 +216,7 @@ async function instrumentRequestStartHttpServerSpan(
             method,
             [URL_FULL]: ctx.url.href,
             [URL_PATH]: ctx.url.pathname,
-            ...httpHeadersToSpanAttributes(
-              winterCGHeadersToDict(request.headers),
-              getClient()?.getDataCollectionOptions() ?? false,
-            ),
+            ...httpHeadersToSpanAttributes(winterCGHeadersToDict(request.headers), client.getDataCollectionOptions()),
           };
 
           if (parametrizedRoute) {

packages/bun/src/integrations/bunserver.ts

@@ -221,7 +221,9 @@ function wrapRequestHandler<T extends RouteHandler = RouteHandler>(
     const client = getClient();
     const dataCollection = client?.getDataCollectionOptions();
 
-    Object.assign(attributes, httpHeadersToSpanAttributes(request.headers.toJSON(), dataCollection));
+    if (dataCollection) {
+      Object.assign(attributes, httpHeadersToSpanAttributes(request.headers.toJSON(), dataCollection));
+    }
 
     isolationScope.setSDKProcessingMetadata({
       normalizedRequest: {
@@ -254,7 +256,11 @@ function wrapRequestHandler<T extends RouteHandler = RouteHandler>(
                   status_code: response.status,
                 });
 
-                span.setAttributes(httpHeadersToSpanAttributes(response.headers.toJSON(), dataCollection, 'response'));
+                if (dataCollection) {
+                  span.setAttributes(
+                    httpHeadersToSpanAttributes(response.headers.toJSON(), dataCollection, 'response'),
+                  );
+                }
               }
               return response;
             } catch (e) {

packages/cloudflare/src/baseSdk.ts

@@ -60,7 +60,6 @@ export function getBaseDefaultIntegrations(options: CloudflareOptions): Integrat
     linkedErrorsIntegration(),
     fetchIntegration(),
     httpServerIntegration(),
-    // oxlint-disable-next-line typescript/no-deprecated
     requestDataIntegration(),
     consoleIntegration(),
     // The orchestrion diagnostics-channel subscribers (mysql, pg, …). The

packages/cloudflare/src/request.ts

@@ -2,7 +2,6 @@ import type { CfProperties, IncomingRequestCfProperties } from '@cloudflare/work
 import {
   captureException,
   continueTrace,
-  getClient,
   getHttpSpanDetailsFromUrlObject,
   httpHeadersToSpanAttributes,
   parseStringToURLObject,
@@ -100,13 +99,12 @@ export function wrapRequestHandlerWithInit(
       attributes['user_agent.original'] = userAgentHeader;
     }
 
-    Object.assign(
-      attributes,
-      httpHeadersToSpanAttributes(
-        winterCGHeadersToDict(request.headers),
-        getClient()?.getDataCollectionOptions() ?? false,
-      ),
-    );
+    if (client) {
+      Object.assign(
+        attributes,
+        httpHeadersToSpanAttributes(winterCGHeadersToDict(request.headers), client.getDataCollectionOptions()),
+      );
+    }
 
     attributes[SEMANTIC_ATTRIBUTE_SENTRY_OP] = 'http.server';