nextjs: Turbopack applicationKey metadata adds 93.6 kB gzip to the browser bundle; opt-out for node_modules? #25754

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/nextjs

SDK Version

10.76.1 (same rule on 11.9.0 and develop)

Framework Version

16.3.6

Link to Sentry event

No response

Reproduction Example/SDK Setup

// next.config.ts
export default withSentryConfig(nextConfig, { applicationKey: "my-app" })

// instrumentation-client.ts
Sentry.init({
  dsn: "...",
  integrations: [
    Sentry.thirdPartyErrorFilterIntegration({
      filterKeys: ["my-app"],
      behaviour: "apply-tag-if-exclusively-contains-third-party-frames",
    }),
  ],
})

Steps to Reproduce

1. Set applicationKey on a Next 16 app building with Turbopack.
2. next build with it and without it.
3. Compare First Load JS per route, and count _sentryModuleMetadata[...stack]=Object.assign in .next/static.

Expected Result

A supported way to keep thirdPartyErrorFilterIntegration without tagging every bundled dependency.

Actual Result

Not a bug report against the current condition. cd05479 (#19645) removed not: 'foreign' deliberately, for BannerPlugin parity and to fix #19320; the try-catch IIFE makes it safe for strict-init node_modules.

The browser-side cost looks unmeasured. One Next 16.3.6 app:

Stripping each try{...}catch(){} span and re-gzipping:

First Load JS across 113 routes: +11.2 to +29.0 kB, median +13.1, integration included.

Each site evaluates new Error().stack twice at module-evaluation time.

Additional Context

Asking for an opt-out, not a change of default: a flag to exclude foreign modules, or a user-supplied condition for the rule.

#19320 was about the contains behaviour, which uses some and does need node_modules tagged. The exclusively behaviour uses every, so untagged dependency frames only change errors whose frames sit entirely inside bundled dependencies. Apps using exclusively against injected in-app-browser scripts get little for the 93.6 kB.

We added the same matcher with condition: { not: 'foreign' } pointing at moduleMetadataInjectionLoader.js. It halved our median route cost, but resolves a path outside your exports map.

Related: #19320, #19645, #25544 / #25565, #23402.

Priority

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.}