Update span attributes to use @sentry/conventions #18895

Description

For the next Major SDK version, we should stop sending attributes we deprecated in our conventions and (if not done already) replace them with their stable replacements.

Overall, we should likely move to our @sentry/conventions package generally and unify usage there. We need to make sure that we do not remove anything users may heavily rely on (or that this is backfilled or similar, …)

Locations marked (reads) only consume the deprecated attribute for back-compat and can likely stay (or be dropped last); everything else actively sets it.

AI Attributes (ai.*)

packages/server-utils/src/ai/langgraph/index.ts already uses GEN_AI_PIPELINE_NAME — Vercel AI is the only holdout.

Code Attributes (code.*)

Note: as of @sentry/conventions@0.19.0, code.function is not yet flagged @deprecated (it and code.function.name are listed as aliases), but it will be deprecated in favor of code.function.name — so migrate it along with code.filepath. The packages/remix/src/server/integrations/opentelemetry.ts occurrence from the original audit is gone with the file.

Database Attributes (db.*)

Almost all of these moved into packages/server-utils/src/ when the OTel DB instrumentations were vendored. They are set via the deprecated @sentry/conventions constants (DB_SYSTEM, DB_STATEMENT, …) or via local ATTR_DB_* string constants.

packages/server-utils/src/integrations/ioredis.ts and redis.ts already carry TODO(v11) comments for exactly this migration.

Note: db.user, db.connection_string and db.sql.table are not deprecated in @sentry/conventions@0.19.0 — no action needed there.

HTTP Attributes (http.*)

The old node-core HTTP integration is gone. Server-side HTTP attributes now live in packages/core/src/integrations/http/ and packages/node/src/integrations/http/httpServerSpansIntegration.ts (the latter sets them deliberately, guarded by eslint-disable typescript/no-deprecated, for compatibility with what @opentelemetry/instrumentation-http used to emit).

Network Attributes (net.*)

GenAI Attributes (gen_ai.*)

All AI instrumentation moved to packages/server-utils/src/ai/ and grew from 2 providers to 7+. These are set via the deprecated constants from @sentry/conventions/attributes.

Caveat documented in server-utils/src/ai/workers-ai/utils.ts: Relay migrates gen_ai.response.text into gen_ai.output.messages, but not the tool-calls half — so dropping gen_ai.response.tool_calls needs product-side coordination before it can be removed.

Other Deprecated Attributes

Already resolved since the original audit

These rows from the original audit no longer apply and were removed:

• ai.model.provider — no longer emitted; Vercel AI now sets gen_ai.provider.name plus the non-deprecated vercel.ai.model.provider. server-utils/src/ai/vercel-ai/index.ts even renames incoming gen_ai.system → gen_ai.provider.name.
• http.url — zero occurrences left in packages/*/src; fully migrated to url.full.
• gen_ai.request.messages / gen_ai.request.available_tools — zero occurrences left; migrated to gen_ai.input.messages / gen_ai.tool.definitions.
• profile_id — migrated to sentry.profile_id (core/src/semanticAttributes.ts, core/src/tracing/spans/scopeContextAttributes.ts). Remaining profile_id hits are event/context payload fields, not span attributes.
• replay_id — the span-attribute case is sentry.replay_id (replay-internal/src/integration.ts, browser-utils/src/web-vitals/spans.ts, core/src/logs/internal.ts, core/src/metrics/internal.ts). Remaining replay_id hits are DSC / feedback-context fields and doc comments, not span attributes.
• The entire "OpenTelemetry Semantic Convention Constants Used (Deprecated)" section — @opentelemetry/semantic-conventions and all SEMATTRS_* constants have been removed from the repo (zero hits in packages/ and dev-packages/). Everything now goes through @sentry/conventions/attributes.

Test fixtures

Beyond source, deprecated attributes are asserted on in integration test fixtures across dev-packages/node-integration-tests/suites/{tracing,express,aws-serverless}, dev-packages/deno-integration-tests/suites/orchestrion-* (mongo, mongoose, mysql, mysql2, postgres, tedious), dev-packages/browser-integration-tests/suites/{tracing,integrations}, dev-packages/bun-integration-tests/suites/fetch and dev-packages/cloudflare-integration-tests/suites/vite-autoinstrument. These will need updating alongside each source change.