fix(nextjs): Align Turbopack module metadata injection with webpack behavior (#19645)

- Remove `condition: { not: 'foreign' }` from the Turbopack metadata
injection rule so node_modules (including e.g. React) are tagged as
first-party, matching webpack's BannerPlugin behavior
- Wrap injected code in a try-catch IIFE (matching the webpack plugin's
`CodeInjection` pattern) to safely handle node_modules with strict
initialization order
- Exclude only `next/dist/build/polyfills/` which contain non-standard
syntax that causes Turbopack parse errors

Fixes the `thirdPartyErrorFilterIntegration` being unusable in Turbopack
builds — previously, React frames in stack traces were treated as
third-party because node_modules lacked metadata, causing
`apply-tag-if-contains-third-party-frames` to incorrectly tag every
error.
  
closes #19320
(again)

Author: chargome

dev-packages/e2e-tests/test-applications/nextjs-16-bun/app/third-party-filter/page.tsx

@@ -0,0 +1,24 @@
+'use client';
+
+import * as Sentry from '@sentry/nextjs';
+
+function throwFirstPartyError(): void {
+  throw new Error('first-party-error');
+}
+
+export default function Page() {
+  return (
+    <button
+      id="first-party-error-btn"
+      onClick={() => {
+        try {
+          throwFirstPartyError();
+        } catch (e) {
+          Sentry.captureException(e);
+        }
+      }}
+    >
+      Throw First Party Error
+    </button>
+  );
+}

dev-packages/e2e-tests/test-applications/nextjs-16-bun/instrumentation-client.ts

@@ -6,6 +6,12 @@ Sentry.init({
   tunnel: `http://localhost:3031/`, // proxy server
   tracesSampleRate: 1.0,
   sendDefaultPii: true,
+  integrations: [
+    Sentry.thirdPartyErrorFilterIntegration({
+      filterKeys: ['nextjs-16-bun-e2e'],
+      behaviour: 'apply-tag-if-exclusively-contains-third-party-frames',
+    }),
+  ],
 });
 
 export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

dev-packages/e2e-tests/test-applications/nextjs-16-bun/next.config.ts

@@ -5,4 +5,7 @@ const nextConfig: NextConfig = {};
 
 export default withSentryConfig(nextConfig, {
   silent: true,
+  _experimental: {
+    turbopackApplicationKey: 'nextjs-16-bun-e2e',
+  },
 });

dev-packages/e2e-tests/test-applications/nextjs-16-bun/tests/third-party-filter.test.ts

@@ -0,0 +1,28 @@
+import test, { expect } from '@playwright/test';
+import { waitForError } from '@sentry-internal/test-utils';
+
+const isWebpackDev = process.env.TEST_ENV === 'development-webpack';
+
+test('First-party error should not be tagged as third-party with exclusively-contains mode', async ({ page }) => {
+  test.skip(isWebpackDev, 'Only relevant for Turbopack builds');
+
+  const errorPromise = waitForError('nextjs-16-bun', errorEvent => {
+    return errorEvent?.exception?.values?.some(value => value.value === 'first-party-error') ?? false;
+  });
+
+  await page.goto('/third-party-filter');
+  await page.locator('#first-party-error-btn').click();
+
+  const errorEvent = await errorPromise;
+
+  expect(errorEvent.exception?.values?.[0]?.value).toBe('first-party-error');
+
+  // In production, TEST_ENV=production is shared by both turbopack and webpack variants.
+  // Only assert when the build is actually turbopack.
+  if (errorEvent.tags?.turbopack) {
+    // The integration uses `apply-tag-if-exclusively-contains-third-party-frames` which
+    // only tags errors if ALL frames are third-party. A first-party error with React frames
+    // should not be tagged because the first-party frames have metadata.
+    expect(errorEvent.tags?.third_party_code).toBeUndefined();
+  }
+});

dev-packages/e2e-tests/test-applications/nextjs-16/instrumentation-client.ts

@@ -10,7 +10,7 @@ Sentry.init({
   integrations: [
     Sentry.thirdPartyErrorFilterIntegration({
       filterKeys: ['nextjs-16-e2e'],
-      behaviour: 'apply-tag-if-exclusively-contains-third-party-frames',
+      behaviour: 'apply-tag-if-contains-third-party-frames',
     }),
   ],
   // Verify Log type is available

dev-packages/e2e-tests/test-applications/nextjs-16/tests/third-party-filter.test.ts

@@ -3,7 +3,7 @@ import { waitForError } from '@sentry-internal/test-utils';
 
 const isWebpackDev = process.env.TEST_ENV === 'development-webpack';
 
-test('First-party error should not be tagged as third-party code', async ({ page }) => {
+test('First-party error with React frames should not be tagged as third-party code', async ({ page }) => {
   test.skip(isWebpackDev, 'Only relevant for Turbopack builds');
 
   const errorPromise = waitForError('nextjs-16', errorEvent => {
@@ -20,6 +20,11 @@ test('First-party error should not be tagged as third-party code', async ({ page
   // In production, TEST_ENV=production is shared by both turbopack and webpack variants.
   // Only assert when the build is actually turbopack.
   if (errorEvent.tags?.turbopack) {
+    // The integration uses `apply-tag-if-contains-third-party-frames` which tags errors
+    // if ANY frame is third-party. This error is thrown inside a React onClick handler,
+    // so the stack trace contains React frames from node_modules. These must NOT be
+    // treated as third-party — the module metadata injection must cover node_modules too
+    // (matching the webpack plugin's behavior).
     expect(errorEvent.tags?.third_party_code).toBeUndefined();
   }
 });

packages/nextjs/src/config/loaders/moduleMetadataInjectionLoader.ts

@@ -26,14 +26,18 @@ export default function moduleMetadataInjectionLoader(
   this.cacheable(false);
 
   // The snippet mirrors what @sentry/webpack-plugin injects for moduleMetadata.
-  // We access _sentryModuleMetadata via globalThis (not as a bare variable) to avoid
-  // ReferenceError in strict mode. Each module is keyed by its Error stack trace so that
-  // the SDK can map filenames to metadata at runtime.
+  // It is wrapped in a try-catch IIFE (matching the webpack plugin's CodeInjection pattern)
+  // so that injection failures in node_modules or unusual environments never break the module.
+  // The IIFE resolves the global object and stores metadata keyed by (new Error).stack
+  // so the SDK can map chunk filenames to metadata at runtime.
   // Not putting any newlines in the generated code will decrease the likelihood of sourcemaps breaking.
   const metadata = JSON.stringify({ [`_sentryBundlerPluginAppKey:${applicationKey}`]: true });
   const injectedCode =
-    ';globalThis._sentryModuleMetadata = globalThis._sentryModuleMetadata || {};' +
-    `globalThis._sentryModuleMetadata[(new Error).stack] = Object.assign({}, globalThis._sentryModuleMetadata[(new Error).stack], ${metadata});`;
+    ';!function(){try{' +
+    'var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{};' +
+    'e._sentryModuleMetadata=e._sentryModuleMetadata||{},' +
+    `e._sentryModuleMetadata[(new e.Error).stack]=Object.assign({},e._sentryModuleMetadata[(new e.Error).stack],${metadata});` +
+    '}catch(e){}}();';
 
   return userCode.replace(SKIP_COMMENT_AND_DIRECTIVE_REGEX, match => {
     return match + injectedCode;

packages/nextjs/src/config/turbopack/constructTurbopackConfig.ts

@@ -58,15 +58,20 @@ export function constructTurbopackConfig({
   }
 
   // Add module metadata injection loader for thirdPartyErrorFilterIntegration support.
-  // This is only added when turbopackApplicationKey is set AND the Next.js version supports the
-  // `condition` field in Turbopack rules (Next.js 16+). Without `condition: { not: 'foreign' }`,
-  // the loader would tag node_modules as first-party, defeating the purpose.
+  // This loader tags modules with `_sentryModuleMetadata` so the integration can tell
+  // first-party code from third-party code. We intentionally do NOT use
+  // `condition: { not: 'foreign' }` so that node_modules are also tagged as first-party,
+  // matching the webpack plugin's BannerPlugin behavior (which injects into all chunks
+  // without excluding node_modules). The injected code is wrapped in a try-catch IIFE
+  // so it is safe even for node_modules with strict initialization order.
+  // We only exclude Next.js build polyfills which contain non-standard syntax that causes
+  // parse errors when any code is prepended (Turbopack re-parses the loader output).
   const applicationKey = userSentryOptions?._experimental?.turbopackApplicationKey;
   if (applicationKey && nextJsVersion && supportsTurbopackRuleCondition(nextJsVersion)) {
     newConfig.rules = safelyAddTurbopackRule(newConfig.rules, {
       matcher: '*.{ts,tsx,js,jsx,mjs,cjs}',
       rule: {
-        condition: { not: 'foreign' },
+        condition: { not: { path: /next\/dist\/build\/polyfills/ } },
         loaders: [
           {
             loader: path.resolve(__dirname, '..', 'loaders', 'moduleMetadataInjectionLoader.js'),

packages/nextjs/test/config/moduleMetadataInjectionLoader.test.ts

@@ -31,7 +31,8 @@ describe('moduleMetadataInjectionLoader', () => {
 
     expect(result).toContain('_sentryModuleMetadata');
     expect(result).toContain('_sentryBundlerPluginAppKey:my-app');
-    expect(result).toContain('Object.assign');
+    // Wrapped in try-catch IIFE
+    expect(result).toContain('!function(){try{');
   });
 
   it('should inject after "use strict" directive', () => {
@@ -104,16 +105,20 @@ describe('moduleMetadataInjectionLoader', () => {
     expect(result).toContain('_sentryBundlerPluginAppKey:my-app');
   });
 
-  it('should use globalThis and Object.assign merge pattern keyed by stack trace', () => {
+  it('should use try-catch IIFE pattern matching the webpack plugin', () => {
     const loaderThis = createLoaderThis('my-app');
     const userCode = 'const x = 1;';
 
     const result = moduleMetadataInjectionLoader.call(loaderThis, userCode);
 
-    // Should use globalThis to avoid ReferenceError in strict mode
-    expect(result).toContain('globalThis._sentryModuleMetadata = globalThis._sentryModuleMetadata || {}');
+    // Should be wrapped in a try-catch IIFE so injection failures never break the module
+    expect(result).toContain('!function(){try{');
+    expect(result).toContain('}catch(e){}}();');
+    // Should resolve the global object like the webpack plugin does
+    expect(result).toContain('typeof window');
+    expect(result).toContain('typeof globalThis');
     // Should key by stack trace like the webpack plugin does
-    expect(result).toContain('globalThis._sentryModuleMetadata[(new Error).stack]');
+    expect(result).toContain('e._sentryModuleMetadata[(new e.Error).stack]');
     // Should use Object.assign to merge metadata
     expect(result).toContain('Object.assign({}');
   });

packages/nextjs/test/config/turbopack/constructTurbopackConfig.test.ts

@@ -965,7 +965,7 @@ describe('moduleMetadataInjection with applicationKey', () => {
     });
 
     expect(result.rules!['*.{ts,tsx,js,jsx,mjs,cjs}']).toEqual({
-      condition: { not: 'foreign' },
+      condition: { not: { path: /next\/dist\/build\/polyfills/ } },
       loaders: [
         {
           loader: '/mocked/path/to/moduleMetadataInjectionLoader.js',
@@ -977,6 +977,22 @@ describe('moduleMetadataInjection with applicationKey', () => {
     });
   });
 
+  it('should only exclude Next.js polyfills, not all foreign modules', () => {
+    const userNextConfig: NextConfigObject = {};
+
+    const result = constructTurbopackConfig({
+      userNextConfig,
+      userSentryOptions: { _experimental: { turbopackApplicationKey: 'my-app' } },
+      nextJsVersion: '16.0.0',
+    });
+
+    const rule = result.rules!['*.{ts,tsx,js,jsx,mjs,cjs}'] as { condition?: { not: unknown }; loaders: unknown[] };
+    // Unlike component annotation (which uses { not: 'foreign' }), metadata injection
+    // must cover node_modules to match the webpack plugin's BannerPlugin behavior.
+    // Only Next.js build polyfills are excluded because they have non-standard syntax.
+    expect(rule.condition).toEqual({ not: { path: /next\/dist\/build\/polyfills/ } });
+  });
+
   it('should NOT add metadata loader rule when Next.js < 16', () => {
     const userNextConfig: NextConfigObject = {};
 
@@ -1023,7 +1039,6 @@ describe('moduleMetadataInjection with applicationKey', () => {
     });
 
     const rule = result.rules!['*.{ts,tsx,js,jsx,mjs,cjs}'] as {
-      condition: unknown;
       loaders: Array<{ loader: string; options: { applicationKey: string } }>;
     };
     expect(rule.loaders[0]!.options.applicationKey).toBe('custom-key-123');
@@ -1070,7 +1085,7 @@ describe('moduleMetadataInjection with applicationKey', () => {
     });
 
     expect(result.rules!['*.{ts,tsx,js,jsx,mjs,cjs}']).toEqual({
-      condition: { not: 'foreign' },
+      condition: { not: { path: /next\/dist\/build\/polyfills/ } },
       loaders: [
         {
           loader: '/mocked/path/to/moduleMetadataInjectionLoader.js',