Restore packed SDK consumers after upstream Sentry declaration regression

Merged
UN
3mo ago
+40-6

Summary

  • pin @sentry/node to the last verified packed-consumer-safe 10.65.0 release
  • align the pnpm lockfile with the public exact dependency contract
  • ratchet the dependency in package-manifest tests so a future refresh must explicitly re-prove packed NodeNext declarations
  • preserve the broader Bun/release recovery lineage from PR #668 and the stable npm channel fix from PR #670

Why

A clean 2026.7.24-3 release preparation twice passed build, types, docs, strict static quality, secret scanning, and exact 100% coverage. A fresh tarball consumer then resolved the public caret range to @sentry/node@10.68.0. Its @sentry/server-utils@10.68.0 dependency pins @apm-js-collab/code-transformer-bundler-plugins@0.7.1, whose CJS declarations fail strict NodeNext compilation with TS2307 for ./instrumentation-serde. Consumers do not inherit this repository’s pnpm lockfile.

PM lineage

  • pm-cedo0g — end-to-end Bun and release recovery (active until production publication is verified)
  • pm-gis0qo — merged explicit stable npm dist-tag fix

Verification

  • red packed smoke reproduced the upstream TS2307 declaration failure
  • pnpm smoke:npx passes a fresh npm tarball install, CLI execution, SDK import, and strict NodeNext TypeScript compile
  • tests/unit/packages/package-manifest.spec.ts: 18/18 passing
  • pnpm quality:static: passing, including 100% docstring/export/member thresholds, package-boundary, and token-budget gates
  • pnpm security:scan: no credential-like secrets

No source runtime behavior changes; this makes the published dependency graph match the already verified lockfile graph.

Summary by cubic

Pins @sentry/node to 10.65.0 to restore strict NodeNext compatibility for packed npm consumers and stop TS2307 declaration errors. Also updates the changelog to record the stable-channel dist-tag fix.

  • Bug Fixes

    • Prevents TS2307 errors in strict NodeNext when fresh installs resolve @sentry/node@10.68.0 via @sentry/server-utils.
    • Adds an Unreleased CHANGELOG entry documenting the explicit stable dist-tag requirement.

  • Dependencies

    • Sets @sentry/node to exact 10.65.0 in package.json.
    • Updates pnpm-lock.yaml to match.
    • Adds a manifest test to ratchet the exact Sentry version until upstream declarations are NodeNext-safe.