chore: Replace lerna with lightweight versioning script

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove lerna and replace its two uses with lighter alternatives:

• lerna version → scripts/bump-version.js — a ~80-line Node script that updates all workspace package.json versions and @sentry-internal/* cross-references to the exact new version. Modeled after sentry-javascript#19325.
• lerna run build:tarball → turbo run build:tarball — Turborepo is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#217	HIGH	tar	Symlink Path Traversal via Drive-Relative Linkpath
#216	HIGH	tar	Hardlink Path Traversal via Drive-Relative Linkpath
#185	HIGH	tar	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain
#176	HIGH	tar	Arbitrary File Creation/Overwrite via Hardlink Path Traversal
#174	HIGH	tar	Race Condition via Unicode Ligature Collisions on macOS APFS
#172	HIGH	tar	Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
#137	HIGH	axios	SSRF and Credential Leakage via Absolute URL

Partially resolved (some vulnerable entries removed, but the package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#213, #208, #207, #205	HIGH	minimatch	markdownlint-cli, vite-plugin-dts still pull in vulnerable versions
#161	HIGH	glob	markdownlint-cli, web-ext-run still pull in vulnerable versions
#136, #135	CRITICAL	form-data	jest (via jsdom) still pulls in form-data@3.0.2
#158, #157	MEDIUM	js-yaml	@changesets/cli, jest still pull in js-yaml@3.14.1

The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping markdownlint-cli, @changesets/cli, jest/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this repo.

[linear-code]

SDK-1094 Remove Lerna (~10 alerts, 2 critical)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}