Repository navigation
Restore packed SDK consumers after upstream Sentry declaration regression - #671
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
@coderabbitai full review @greptileai please review the exact current head. Focus on public npm dependency reproducibility, the Sentry pin tradeoff, the packed strict-NodeNext consumer proof, and whether the test ratchet is appropriately scoped. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Warning Review limit reached
Next review available in: 1 minute Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 8 minutes. |
Merging this PR will regress 3 benchmarks
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ❌ | normalizeLowercaseWhitespace |
135.8 µs | 135.9 µs | -0.02% |
| ❌ | tokenizeAlphaNumeric |
367.3 µs | 367.3 µs | 0% |
| ❌ | score query over 2000 docs |
5.6 ms | 5.6 ms | 0% |
| ⚡ | createQueryFingerprint |
519.9 µs | 517.1 µs | +0.55% |
| ⚡ | encodeQueryCursor |
101.1 µs | 101 µs | +0.12% |
| ⚡ | stableStringify (nested contract) |
161.5 µs | 161.4 µs | +0.06% |
| ⚡ | decodeQueryCursor |
114.4 µs | 114.3 µs | +0.05% |
| ⚡ | build index (2000 docs x 80 words) |
161.4 ms | 161.3 ms | +0.01% |
| ⚡ | jaccardSimilarity |
153.3 µs | 153.3 µs | +0.01% |
| ⚡ | tokenize + score query over 2000 docs |
7.5 ms | 7.5 ms | +0.01% |
| ⚡ | build index (200 docs x 40 words) |
8.4 ms | 8.4 ms | 0% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing fix/sentry-packed-consumer-declarations (e6e026c) with main (06c3ee3)
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Bot/check response for head
The exact Sentry pin remains backed by a fresh packed npm + strict NodeNext consumer, and all changes are recorded in @coderabbitai full review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== PR metadata =='
gh pr view 671 --repo unbraind/pm-cli --json number,baseRefName,headRefName,headRefOid,title,files --jq '{number, baseRefName, headRefName, headRefOid, title, files: [.files[].path]}'
printf '%s\n' '== Working-tree revision and changed paths vs merge base =='
git rev-parse HEAD
base="$(git merge-base "origin/$(gh pr view 671 --repo unbraind/pm-cli --json baseRefName --jq .baseRefName)" HEAD)"
printf 'merge-base=%s\n' "$base"
git diff --name-status "$base"...HEAD
printf '%s\n' '== Focused structural maps =='
for name in package.json pnpm-lock.yaml package-manifest.spec.ts; do
f="$(fd -a -t f "^${name//./\\.}$" . | head -n1 || true)"
if [ -n "$f" ]; then
printf '\n-- %s --\n' "$f"
case "$f" in
*.ts) ast-grep outline "$f" --items all || true ;;
*) sed -n '1,80p' "$f" ;;
esac
fi
done
printf '%s\n' '== Changed diff (text files) =='
git diff --unified=80 "$base"...HEAD -- \
package.json pnpm-lock.yaml \
':(glob)**/package-manifest.spec.ts' \
':(glob)**/changelog*' \
':(glob)**/CHANGELOG*' \
':(glob)**/package.json'Length of output: 29955 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base origin/main HEAD)"
printf '%s\n' '== Locate and map packed-consumer smoke implementation =='
fd -a -t f 'smoke-npx-from-pack\.mjs|package\.json$' . \
| sed -n '1,160p'
smoke="$(fd -a -t f '^smoke-npx-from-pack\.mjs$' . | head -n1 || true)"
if [ -n "$smoke" ]; then
printf '\n-- outline: %s --\n' "$smoke"
ast-grep outline "$smoke" --items all || true
printf '\n-- contents: %s --\n' "$smoke"
cat -n "$smoke"
fi
printf '%s\n' '== Root package publication fields =='
python3 - <<'PY'
import json
from pathlib import Path
p = Path("package.json")
data = json.loads(p.read_text())
for k in ("name", "version", "files", "exports", "dependencies", "publishConfig", "scripts"):
print(f"{k} = {json.dumps(data.get(k), indent=2, sort_keys=True)}")
PY
printf '%s\n' '== Complete changed PM/changelog metadata =='
git diff --unified=30 "$base"...HEAD -- \
.agents/pm/history/pm-cedo0g.jsonl \
.agents/pm/issues/pm-cedo0g.toon \
CHANGELOG.md
printf '%s\n' '== Sentry declaration / version references in source, release scripts, and tests =='
rg -n -C 3 --glob '!pnpm-lock.yaml' --glob '!CHANGELOG.md' \
'`@sentry/node`|10\.65\.0|smoke:npx|smoke-npx-from-pack' \
package.json scripts tests src .agents/pm 2>/dev/null || trueLength of output: 201826 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base origin/main HEAD)"
printf '%s\n' '== Packed consumer smoke script =='
cat -n scripts/smoke-npx-from-pack.mjs
printf '%s\n' '== Root manifest publish contract =='
python3 - <<'PY'
import json
data = json.load(open("package.json", encoding="utf-8"))
print("name:", data["name"])
print("version:", data["version"])
print("`@sentry/node`:", data["dependencies"].get("`@sentry/node`"))
print("files:", data.get("files"))
print("sdk export:", json.dumps(data.get("exports", {}).get("./sdk"), sort_keys=True))
print("smoke:npx:", data["scripts"].get("smoke:npx"))
PY
printf '%s\n' '== Sentry-specific changed PM evidence (only changed lines) =='
git diff --unified=5 "$base"...HEAD -- \
.agents/pm/history/pm-cedo0g.jsonl \
.agents/pm/issues/pm-cedo0g.toon \
| rg -n -i -C 5 'sentry|10\.65\.0|smoke:npx|nodenext|TS2307|packed|npm tarball|declaration' || true
printf '%s\n' '== Published dependency and lock importer consistency =='
python3 - <<'PY'
import json, re
package = json.load(open("package.json", encoding="utf-8"))
lock = open("pnpm-lock.yaml", encoding="utf-8").read()
assert package["dependencies"]["`@sentry/node`"] == "10.65.0"
m = re.search(r"^ '`@sentry/node`':\n specifier: (.+)\n version: (.+)$", lock, re.M)
assert m, "missing root lockfile importer entry"
print("manifest:", package["dependencies"]["`@sentry/node`"])
print("lockfile specifier:", m.group(1))
print("lockfile resolved:", m.group(2))
assert m.group(1) == package["dependencies"]["`@sentry/node`"]
assert m.group(2).startswith(package["dependencies"]["`@sentry/node`"])
PYLength of output: 27410
Reviewed areas:
I could not execute runtime commands in this sandbox; the conclusion combines static inspection with the reported passing smoke, manifest-test, static-quality, security, and changelog checks. ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 1 minute. |
|
Acknowledged the final exact-head CodeRabbit review and Codecov report with positive reactions. CodeRabbit found no issues and independently confirmed the exact public Sentry contract, lockfile parity, isolated strict-NodeNext packed consumer, and deliberate upgrade ratchet. Codecov confirms every changed coverable line is covered and all tests pass. |
Summary
@sentry/nodeto the last verified packed-consumer-safe10.65.0releaseWhy
A clean
2026.7.24-3release preparation twice passed build, types, docs, strict static quality, secret scanning, and exact 100% coverage. A fresh tarball consumer then resolved the public caret range to@sentry/node@10.68.0. Its@sentry/server-utils@10.68.0dependency pins@apm-js-collab/code-transformer-bundler-plugins@0.7.1, whose CJS declarations fail strict NodeNext compilation withTS2307for./instrumentation-serde. Consumers do not inherit this repository’s pnpm lockfile.PM lineage
Verification
TS2307declaration failurepnpm smoke:npxpasses a fresh npm tarball install, CLI execution, SDK import, and strict NodeNext TypeScript compiletests/unit/packages/package-manifest.spec.ts: 18/18 passingpnpm quality:static: passing, including 100% docstring/export/member thresholds, package-boundary, and token-budget gatespnpm security:scan: no credential-like secretsNo source runtime behavior changes; this makes the published dependency graph match the already verified lockfile graph.
Summary by cubic
Pins
@sentry/nodeto10.65.0to restore strict NodeNext compatibility for packed npm consumers and stop TS2307 declaration errors. Also updates the changelog to record the stable-channel dist-tag fix.Bug Fixes
@sentry/node@10.68.0via@sentry/server-utils.Dependencies
@sentry/nodeto exact10.65.0inpackage.json.pnpm-lock.yamlto match.Written for commit e6e026c. Summary will update on new commits.