ref(core)!: Rename deprecated http.* span attributes

Part of the v11 migration away from attributes `@sentry/conventions` marks
deprecated. This PR covers the renames on HTTP spans, all of them 1:1 with no
behavior change. `http.target` and the Node body size behavior change follow in
stacked PRs; the `net.*` attributes are migrated separately in #23301.

`http.method` -> `http.request.method`, `http.status_code` ->
`http.response.status_code`, `http.status_text` -> `http.response.status_text`,
`http.scheme` -> `url.scheme`, `http.user_agent` -> `user_agent.original`,
`http.request_content_length` -> `http.request.body.size`,
`http.request_content_length_uncompressed` -> `http.request.body.decoded_size`,
`http.response_content_length` -> `http.response.body.size`,
`http.response_content_length_uncompressed` and
`http.decoded_response_content_length` -> `http.response.body.decoded_size`,
`http.response_transfer_size` -> `http.response.size`, and `url.same_origin` ->
`http.request.same_origin`.

The last two legacy response body size names meant the same thing — the decoded
response body size. Node HTTP spans used `http.response_content_length_uncompressed`,
browser resource spans used `http.decoded_response_content_length`.

Which of the encoded and decoded attribute an HTTP span sets is unchanged here:
the code still branches on whether a `content-encoding` header is present. That
branching is what the stacked body size PR addresses.

`http.host`, `http.flavor` and `http.client_ip` are dropped without a
replacement being set here. Their replacements — `server.address`,
`network.protocol.version` and `client.address` — are introduced by #23301, so
setting them here too would mean two PRs writing the same keys with different
values.

`SanitizedRequestData`, the shape backing `http` breadcrumb data, now keys the
method as `http.request.method`.

Span attributes in the touched files are now imported from
`@sentry/conventions/attributes` rather than written as string literals. That is
what surfaced `url.same_origin` as deprecated; as a literal it was invisible.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: msonnb

dev-packages/browser-integration-tests/suites/integrations/graphqlClient/fetch/test.ts

@@ -48,7 +48,7 @@ sentryTest('should update spans for GraphQL fetch requests', async ({ getLocalTe
     status: 'ok',
     data: expect.objectContaining({
       type: 'fetch',
-      'http.method': 'POST',
+      'http.request.method': 'POST',
       'url.full': 'http://sentry-test.io/foo',
       'server.address': 'sentry-test.io',
       'sentry.op': 'http.client',

dev-packages/browser-integration-tests/suites/integrations/graphqlClient/persistedQuery-fetch/test.ts

@@ -42,7 +42,7 @@ sentryTest('should update spans for GraphQL persisted query fetch requests', asy
     status: 'ok',
     data: expect.objectContaining({
       type: 'fetch',
-      'http.method': 'POST',
+      'http.request.method': 'POST',
       'url.full': 'http://sentry-test.io/graphql',
       'server.address': 'sentry-test.io',
       'sentry.op': 'http.client',

dev-packages/browser-integration-tests/suites/integrations/graphqlClient/persistedQuery-xhr/test.ts

@@ -42,7 +42,7 @@ sentryTest('should update spans for GraphQL persisted query XHR requests', async
     status: 'ok',
     data: {
       type: 'xhr',
-      'http.method': 'POST',
+      'http.request.method': 'POST',
       'url.full': 'http://sentry-test.io/graphql',
       'server.address': 'sentry-test.io',
       'sentry.op': 'http.client',

dev-packages/browser-integration-tests/suites/integrations/graphqlClient/xhr/test.ts

@@ -48,7 +48,7 @@ sentryTest('should update spans for GraphQL XHR requests', async ({ getLocalTest
     status: 'ok',
     data: {
       type: 'xhr',
-      'http.method': 'POST',
+      'http.request.method': 'POST',
       'url.full': 'http://sentry-test.io/foo',
       'server.address': 'sentry-test.io',
       'sentry.op': 'http.client',

dev-packages/browser-integration-tests/suites/tracing/ignoreSpans-streamed/attributes/init.js

@@ -5,7 +5,7 @@ window.Sentry = Sentry;
 Sentry.init({
   dsn: 'https://public@dsn.ingest.sentry.io/1337',
   integrations: [Sentry.spanStreamingIntegration()],
-  ignoreSpans: [{ attributes: { 'http.status_code': 200 } }],
+  ignoreSpans: [{ attributes: { 'http.response.status_code': 200 } }],
   tracesSampleRate: 1,
   debug: true,
 });

dev-packages/browser-integration-tests/suites/tracing/ignoreSpans-streamed/attributes/subject.js

@@ -1,11 +1,11 @@
 // This segment span matches ignoreSpans via attributes — segment + child should be dropped
-Sentry.startSpan({ name: 'health-check', attributes: { 'http.status_code': 200 } }, () => {
+Sentry.startSpan({ name: 'health-check', attributes: { 'http.response.status_code': 200 } }, () => {
   Sentry.startSpan({ name: 'child-of-ignored' }, () => {});
 });
 
 setTimeout(() => {
   // This segment span does NOT match — segment + child should be sent
-  Sentry.startSpan({ name: 'normal-segment', attributes: { 'http.status_code': 500 } }, () => {
+  Sentry.startSpan({ name: 'normal-segment', attributes: { 'http.response.status_code': 500 } }, () => {
     Sentry.startSpan({ name: 'child-span' }, () => {});
   });
 }, 1000);

dev-packages/browser-integration-tests/suites/tracing/metrics/pageload-resource-spans/test.ts

@@ -68,7 +68,7 @@ sentryTest('adds resource spans to pageload transaction', async ({ getLocalTestU
   // The init bundle script is served from the test origin: its description is origin-relative,
   // but `url.full` retains the full absolute URL (needed for span description inference).
   const sameOriginScriptSpan = scriptSpans?.find(({ description }) => description === '/init.bundle.js');
-  expect(sameOriginScriptSpan?.data?.['url.same_origin']).toBe(true);
+  expect(sameOriginScriptSpan?.data?.['http.request.same_origin']).toBe(true);
   expect(sameOriginScriptSpan?.data?.['url.full']).toMatch(/^https?:\/\/.+\/init\.bundle\.js$/);
 
   const customScriptSpan = scriptSpans?.find(
@@ -77,9 +77,9 @@ sentryTest('adds resource spans to pageload transaction', async ({ getLocalTestU
 
   expect(imgSpan).toEqual({
     data: {
-      'http.decoded_response_content_length': expect.any(Number),
-      'http.response_content_length': expect.any(Number),
-      'http.response_transfer_size': expect.any(Number),
+      'http.response.body.decoded_size': expect.any(Number),
+      'http.response.body.size': expect.any(Number),
+      'http.response.size': expect.any(Number),
       'http.request.connect_start': expect.any(Number),
       'http.request.connection_end': expect.any(Number),
       'http.request.domain_lookup_end': expect.any(Number),
@@ -99,7 +99,7 @@ sentryTest('adds resource spans to pageload transaction', async ({ getLocalTestU
       [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: 'auto.resource.browser.metrics',
       'server.address': 'sentry-test-site.example',
       'url.domain': 'sentry-test-site.example',
-      'url.same_origin': false,
+      'http.request.same_origin': false,
       'url.scheme': 'https',
       'url.full': 'https://sentry-test-site.example/path/to/image.svg',
       ...(!isWebkitRun && {
@@ -127,9 +127,9 @@ sentryTest('adds resource spans to pageload transaction', async ({ getLocalTestU
 
   expect(linkSpan).toEqual({
     data: {
-      'http.decoded_response_content_length': expect.any(Number),
-      'http.response_content_length': expect.any(Number),
-      'http.response_transfer_size': expect.any(Number),
+      'http.response.body.decoded_size': expect.any(Number),
+      'http.response.body.size': expect.any(Number),
+      'http.response.size': expect.any(Number),
       'http.request.connect_start': expect.any(Number),
       'http.request.connection_end': expect.any(Number),
       'http.request.domain_lookup_end': expect.any(Number),
@@ -149,7 +149,7 @@ sentryTest('adds resource spans to pageload transaction', async ({ getLocalTestU
       [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: 'auto.resource.browser.metrics',
       'server.address': 'sentry-test-site.example',
       'url.domain': 'sentry-test-site.example',
-      'url.same_origin': false,
+      'http.request.same_origin': false,
       'url.scheme': 'https',
       'url.full': 'https://sentry-test-site.example/path/to/style.css',
       ...(!isWebkitRun && {
@@ -171,9 +171,9 @@ sentryTest('adds resource spans to pageload transaction', async ({ getLocalTestU
 
   expect(customScriptSpan).toEqual({
     data: {
-      'http.decoded_response_content_length': expect.any(Number),
-      'http.response_content_length': expect.any(Number),
-      'http.response_transfer_size': expect.any(Number),
+      'http.response.body.decoded_size': expect.any(Number),
+      'http.response.body.size': expect.any(Number),
+      'http.response.size': expect.any(Number),
       'http.request.connection_end': expect.any(Number),
       'http.request.connect_start': expect.any(Number),
       'http.request.domain_lookup_end': expect.any(Number),
@@ -193,7 +193,7 @@ sentryTest('adds resource spans to pageload transaction', async ({ getLocalTestU
       'sentry.origin': 'auto.resource.browser.metrics',
       'server.address': 'sentry-test-site.example',
       'url.domain': 'sentry-test-site.example',
-      'url.same_origin': false,
+      'http.request.same_origin': false,
       'url.scheme': 'https',
       'url.full': 'https://sentry-test-site.example/path/to/script.js',
       ...(!isWebkitRun && {

dev-packages/browser-integration-tests/suites/tracing/request/fetch-data-url/test.ts

@@ -26,7 +26,7 @@ sentryTest('sanitizes data URLs in fetch span name and attributes', async ({ get
   expect(span?.description).toBe(`GET ${sanitizedUrl}`);
 
   expect(span?.data).toMatchObject({
-    'http.method': 'GET',
+    'http.request.method': 'GET',
     type: 'fetch',
   });
 

dev-packages/browser-integration-tests/suites/tracing/request/fetch-immediate/test.ts

@@ -30,7 +30,7 @@ sentryTest('should create spans for fetch requests called directly after init',
     timestamp: expect.any(Number),
     trace_id: tracingEvent.contexts?.trace?.trace_id,
     data: {
-      'http.method': 'GET',
+      'http.request.method': 'GET',
       'url.full': 'http://sentry-test-site.example/0',
       'server.address': 'sentry-test-site.example',
       type: 'fetch',

dev-packages/browser-integration-tests/suites/tracing/request/fetch-relative-url/test.ts

@@ -28,7 +28,7 @@ sentryTest('should create spans for fetch requests', async ({ getLocalTestUrl, p
       timestamp: expect.any(Number),
       trace_id: tracingEvent.contexts?.trace?.trace_id,
       data: {
-        'http.method': 'GET',
+        'http.request.method': 'GET',
         'url.full': `${TEST_HOST}/test-req/${index}`,
         'server.address': 'sentry-test.io',
         type: 'fetch',