From 72afd6124a8f78700e20ca27924ad76c5d72b119 Mon Sep 17 00:00:00 2001
From: Abdelrahman Awad <abdelrahman.awad@sentry.io>
Date: Fri, 24 Apr 2026 12:10:03 -0400
Subject: [PATCH 1/3] fix(core): Avoid parse-time SyntaxError on Safari <16.4
 in postgresjs

Closes #20433

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/core/src/integrations/postgresjs.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/integrations/postgresjs.ts b/packages/core/src/integrations/postgresjs.ts
index b01ac13b1708..75d6603b8e07 100644
--- a/packages/core/src/integrations/postgresjs.ts
+++ b/packages/core/src/integrations/postgresjs.ts
@@ -378,7 +378,10 @@ export function _sanitizeSqlQuery(sqlQuery: string | undefined): string {
       .replace(/-?\b\d+\.?\d*[eE][+-]?\d+\b/g, '?') // Scientific notation
       .replace(/-?\b\d+\.\d+\b/g, '?') // Decimals
       .replace(/-?\.\d+\b/g, '?') // Decimals starting with dot
-      .replace(/(?<!\$)-?\b\d+\b/g, '?') // Integers (NOT $n placeholders)
+      // Constructed via `new RegExp` so the negative lookbehind is evaluated at
+      // runtime. As a literal, it is a parse-time SyntaxError on Safari <16.4 —
+      // which breaks any browser bundle that reaches this module via the core barrel.
+      .replace(new RegExp('(?<!\\$)-?\\b\\d+\\b', 'g'), '?') // Integers (NOT $n placeholders)
       // Collapse IN clauses for cardinality (both ? and $n variants)
       .replace(/\bIN\b\s*\(\s*\?(?:\s*,\s*\?)*\s*\)/gi, 'IN (?)')
       .replace(/\bIN\b\s*\(\s*\$\d+(?:\s*,\s*\$\d+)*\s*\)/gi, 'IN ($?)')

From 9f8d83478a4f5734460871571300387d528e85c7 Mon Sep 17 00:00:00 2001
From: Abdelrahman Awad <abdelrahman.awad@sentry.io>
Date: Fri, 24 Apr 2026 12:15:55 -0400
Subject: [PATCH 2/3] refactor(core): Lazy-init integer literal regex

Cache the regex in a module-scope let and build it on first call. Evaluating
it at module scope would still crash Safari <16.4 at import time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/core/src/integrations/postgresjs.ts | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/packages/core/src/integrations/postgresjs.ts b/packages/core/src/integrations/postgresjs.ts
index 75d6603b8e07..e59f242cb209 100644
--- a/packages/core/src/integrations/postgresjs.ts
+++ b/packages/core/src/integrations/postgresjs.ts
@@ -342,6 +342,8 @@ export function _reconstructQuery(strings: string[] | undefined): string | undef
   return strings.reduce((acc, str, i) => (i === 0 ? str : `${acc}$${i}${str}`), '');
 }
 
+let integerLiteralRE: RegExp | undefined;
+
 /**
  * Sanitize SQL query as per the OTEL semantic conventions
  * https://opentelemetry.io/docs/specs/semconv/database/database-spans/#sanitization-of-dbquerytext
@@ -356,6 +358,11 @@ export function _sanitizeSqlQuery(sqlQuery: string | undefined): string {
     return 'Unknown SQL Query';
   }
 
+  // Lazy init: constructing this at module scope would evaluate the lookbehind
+  // on import and crash Safari <16.4 browser bundles that reach this file via
+  // the core barrel. Building it on first call keeps the cost off the import path.
+  integerLiteralRE ??= new RegExp('(?<!\\$)-?\\b\\d+\\b', 'g');
+
   return (
     sqlQuery
       // Remove comments first (they may contain newlines and extra spaces)
@@ -378,10 +385,7 @@ export function _sanitizeSqlQuery(sqlQuery: string | undefined): string {
       .replace(/-?\b\d+\.?\d*[eE][+-]?\d+\b/g, '?') // Scientific notation
       .replace(/-?\b\d+\.\d+\b/g, '?') // Decimals
       .replace(/-?\.\d+\b/g, '?') // Decimals starting with dot
-      // Constructed via `new RegExp` so the negative lookbehind is evaluated at
-      // runtime. As a literal, it is a parse-time SyntaxError on Safari <16.4 —
-      // which breaks any browser bundle that reaches this module via the core barrel.
-      .replace(new RegExp('(?<!\\$)-?\\b\\d+\\b', 'g'), '?') // Integers (NOT $n placeholders)
+      .replace(integerLiteralRE, '?') // Integers (NOT $n placeholders)
       // Collapse IN clauses for cardinality (both ? and $n variants)
       .replace(/\bIN\b\s*\(\s*\?(?:\s*,\s*\?)*\s*\)/gi, 'IN (?)')
       .replace(/\bIN\b\s*\(\s*\$\d+(?:\s*,\s*\$\d+)*\s*\)/gi, 'IN ($?)')

From e25324cd836cad0a380654585d03f481fa105514 Mon Sep 17 00:00:00 2001
From: Abdelrahman Awad <abdelrahman.awad@sentry.io>
Date: Fri, 24 Apr 2026 12:17:54 -0400
Subject: [PATCH 3/3] refactor(core): Use if-guard instead of ??= for regex
 lazy init

Matches the style used elsewhere in the repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/core/src/integrations/postgresjs.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/integrations/postgresjs.ts b/packages/core/src/integrations/postgresjs.ts
index e59f242cb209..da1a7cee17c6 100644
--- a/packages/core/src/integrations/postgresjs.ts
+++ b/packages/core/src/integrations/postgresjs.ts
@@ -361,7 +361,9 @@ export function _sanitizeSqlQuery(sqlQuery: string | undefined): string {
   // Lazy init: constructing this at module scope would evaluate the lookbehind
   // on import and crash Safari <16.4 browser bundles that reach this file via
   // the core barrel. Building it on first call keeps the cost off the import path.
-  integerLiteralRE ??= new RegExp('(?<!\\$)-?\\b\\d+\\b', 'g');
+  if (!integerLiteralRE) {
+    integerLiteralRE = new RegExp('(?<!\\$)-?\\b\\d+\\b', 'g');
+  }
 
   return (
     sqlQuery