@sentry/nextjs modifies app.js output hash by injecting release value

[sekyungk]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/nextjs

SDK Version

9.29.0

Framework Version

React 18.3.1, Next 13.5.11

Link to Sentry event

No response

Reproduction Example/SDK Setup

No response

Steps to Reproduce

1. Use @sentry/nextjs in a Next.js project.
2. Do not set the SENTRY_RELEASE environment variable.
3. Ensure app.tsx has no changes.
4. Build the app with next build.
5. Commit a change (anywhere else in the repo, not in app.tsx) so that the Git commit hash changes.
6. Build again with next build.
7. Compare the two build outputs, especially .next/static/chunks/app-*.js.

➡️ You will see that the hash of app.js has changed even though app.tsx has not been modified.

If you look inside the built app.js, the following line will appear:

...
            return (
              t.push(
                nextjsClientStackFrameNormalizationIntegration({
                  assetPrefix: r,
                  basePath: i,
                  rewriteFramesAssetPrefixPath: n,
                  experimentalThirdPartyOriginStackFrames: a,
                })
              ),
              t
            );
          })(e),
          release: '827cbe163190075f8eaa853f1147d24150bfdd5f',
          ...e,
        };
...

This release value corresponds to the current Git commit hash and is injected automatically into the output by @sentry/nextjs.

This behavior was introduced by this PR.

Expected Result

The build output should be stable and deterministic.

• If files like app.tsx are unchanged, the generated app.js and its hash should remain the same across builds.
• The release value should not be injected into application bundles (like app.js) in a way that changes their content.
• This should apply even if SENTRY_RELEASE is defined

Actual Result

The release field is injected using the current Git commit hash (e.g. '827cbe1631...') even when SENTRY_RELEASE is not defined.
This causes app.js to change and generate a new build hash, even though the source code (like app.tsx) is untouched.

As a result:
Caching is broken