← Back to all posts

By Rox Team

Rox v2026.5.1 Release

Rox v2026.5.1 is out today! 🎉

This release bakes in production-grade error tracking. Out of the box, Rox now speaks the Sentry wire protocol — usable against hosted Sentry, or any API-compatible self-hosted alternative (we test against GlitchTip).

Highlights

🔭 Sentry / GlitchTip integration (#205 / #204)

Error-tracking SDKs are wired into both halves of the stack.

  • Backend: @sentry/bun. Initialization lives in a dedicated src/instrument.ts module that is imported as the very first line of src/index.ts. That ordering matters — it lets the OpenTelemetry-based auto-instrumentation hook the rest of the import graph as it loads.
  • Frontend: @sentry/react. Initialization happens at module load on the client, so even errors raised during the first render are captured.
  • No-op when unconfigured: with SENTRY_DSN / VITE_SENTRY_DSN empty, every Sentry helper short-circuits and the SDK never opens a network connection. Self-hosters who don't want to send telemetry anywhere are not forced into it.

🛡️ Strict PII scrubbing

An ActivityPub server's requests routinely carry sensitive material — Authorization headers, OAuth code / state query parameters, signed-fetch metadata. Rox's Sentry integration strips all of it before events leave the process:

  • event.request.{cookies, data, headers, query_string} are deleted in beforeSend
  • event.user.{email, username, ip_address} are deleted the same way
  • includeServerName: false — the hostname (os.hostname()) is suppressed, since by default Sentry would otherwise tag every event with it

⏰ Cron Monitoring (heartbeat) for background services

The recurring backend services are now wrapped in Sentry Cron Monitoring (Check-ins). If a job stops running, Sentry alerts even though no exception was thrown.

  • ReceivedActivitiesCleanupService (daily)
  • RemoteInstanceRefreshService (hourly)
  • ScheduledNotePublisher (every minute)

A small withMonitor(slug, fn, schedule) helper does the wrapping, so adding more monitored services is a handful of lines. Like everything else here, it's a transparent pass-through when no DSN is configured.

🩺 Observable by design

  • Errors caught by the backend's errorHandler middleware are reported with the Hono route template (e.g. /users/:username) as the route tag. Raw URLs land in extras only — this keeps Sentry's tag index out of high-cardinality trouble.
  • The frontend ErrorBoundary reports caught errors with the React componentStack attached.

Environment

# Backend
SENTRY_DSN=https://xxxx@sentry.example/xxxx
SENTRY_ENVIRONMENT=production
SENTRY_TRACES_SAMPLE_RATE=0.0
SENTRY_RELEASE=2026.5.1

# Frontend (inlined at build time)
VITE_SENTRY_DSN=https://xxxx@sentry.example/xxxx
VITE_SENTRY_ENVIRONMENT=production
VITE_SENTRY_TRACES_SAMPLE_RATE=0.0
VITE_SENTRY_RELEASE=2026.5.1

Other improvements

  • Dependabot now targets the dev branch (#207 / #206) — it matches Rox's release flow and stops generating PRs that fight sync-dev.yml.
  • The TypeScript 6.0.3 and Lingui 6.0.1 upgrades from earlier are carried forward.

Version information

Component Version
Rox (Project) 2026.5.1
Hono Rox (Backend) 1.7.0
Waku Rox (Frontend) 1.7.0
Shared 1.7.0

How to update

git pull origin main
bun install --frozen-lockfile
bun run build

Want Sentry / GlitchTip: set SENTRY_DSN / VITE_SENTRY_DSN in your .env. Don't want it: change nothing. The integration stays dormant.

Feedback and bug reports are welcome on GitHub Issues.

The Love Rocks. Rox. 🚀