MIGRATION.md: v10 to v11 `dataCollection` example silently collects all HTTP headers

[andreiborza]

The "keep the v10 default behavior" snippet in the sendDefaultPii is replaced by dataCollection section produces the opposite of its stated effect for httpHeaders.

The problem

The snippet under #### If you want to keep the v10 default behavior says:

Sentry.init({
  dataCollection: {
    // ...
    httpHeaders: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
    // ...
  },
});

But httpHeaders is not a CollectBehavior. Per packages/core/src/types/datacollection.ts:

httpHeaders?: {
  request?: CollectBehavior;
  response?: CollectBehavior;
};

And packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts resolves it as:

httpHeaders: {
  request: dc.httpHeaders?.request ?? DEFAULTS.httpHeaders.request,   // -> true
  response: dc.httpHeaders?.response ?? DEFAULTS.httpHeaders.response, // -> true
},

A bare deny key matches neither request nor response, so both fall through to the true default and every header is collected — precisely what the snippet claims to prevent. Anyone following the guide to preserve sendDefaultPii: false ends up with full header collection instead.

Correct form

httpHeaders: {
  request: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
  response: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
},

Note

The guide contradicts itself here. About ten lines below the snippet it correctly states:

Each key-value field (cookies, urlQueryParams, httpHeaders.request, httpHeaders.response) accepts true, false, { allow: string[] }, or { deny: string[] } for fine-grained control.

Severity

TypeScript users are protected — the wrong shape fails to compile:

error TS2353: Object literal may only specify known properties, and 'deny' does not
exist in type '{ request?: CollectBehavior | undefined; response?: CollectBehavior | undefined; }'.

JavaScript configs fail silently, with no warning, in a privacy-sensitive direction, while the user believes they have opted out of header collection.

Found while migrating a few apps to 11.0.0-alpha.0. Confirmed present on develop at time of writing.

[linear-code]

JS-3326