chore(ci): Move monorepo to nx by chargome · Pull Request #19325 · getsentry/sentry-javascript

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

Generated by Codecov Action

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

Generated by Codecov Action

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

Generated by Codecov Action

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

Generated by Codecov Action

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

Generated by Codecov Action

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

Generated by Codecov Action

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome · 2026-02-13T14:49:27Z

Replace lerna with Nx for all monorepo task execution (lerna run → nx run-many). Lerna was already using Nx under the hood, so this removes the wrapper layer and uses Nx directly.
Replace lerna version with a custom scripts/bump-version.js for release version bumping. The script replicates lerna version --force-publish --exact --no-git-tag-version --no-push – bumps all workspace package versions and updates internal dependency references to exact versions. Also added some unit tests.
Remove lerna dependency (lerna.json, lerna devDependency) and add nx as a direct devDependency (22.5.0).
Move lockfile stability check to its own CI jo (job_check_lockfile) that runs in parallel with the build.
Configure Nx TUI to auto-exit so yarn build doesn't hang waiting for ESC.
Adds a .version.json as a single source of truth for the current version (this works well with triggering gitflow)
Update docs (CLAUDE.md, CONTRIBUTING.md, .cursor/rules) to reflect the migration.

Closes#19340 (added automatically)

github-actions · 2026-02-13T15:00:06Z

Codecov Results 📊

Generated by Codecov Action

github-actions · 2026-02-13T15:02:00Z

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Scenario	Requests/s	% of Baseline	Prev. Requests/s	Change %
GET Baseline	9,336	-	9,059	+3%
GET With Sentry	1,611	17%	1,586	+2%
GET With Sentry (error only)	5,976	64%	6,061	-1%
POST Baseline	1,190	-	1,185	+0%
POST With Sentry	569	48%	577	-1%
POST With Sentry (error only)	1,039	87%	1,045	-1%
MYSQL Baseline	3,263	-	3,245	+1%
MYSQL With Sentry	476	15%	444	+7%
MYSQL With Sentry (error only)	2,649	81%	2,635	+1%

View base workflow run

# Conflicts: # lerna.json # package.json # yarn.lock

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

WIP
100b47d

chargome self-assigned this Feb 13, 2026

github-advanced-securityAI found potential problems Feb 13, 2026
View reviewed changes

Comment threadscripts/bump-version.js Fixed

chargome added 8 commits February 16, 2026 10:13

Merge branch 'develop' into cg/lerna-bye
b2a6c5f

update commands
abb61f3

fix file race condition
0ceab17

add bump version test commands
ab8f7cb

auto-exit TUI
c646f25

Merge remote-tracking branch 'origin/develop' into cg/lerna-bye
9415afb
# Conflicts: # lerna.json # package.json # yarn.lock

fmt
e8a9f34

optimize yarn lock check
6fdc170

chargome commented Feb 16, 2026
View reviewed changes

Comment thread.github/workflows/build.yml

chargome added 3 commits February 16, 2026 13:32

rm altogether
31d3561

move lockfile checks to a new job
1923f8e

fix dedupe
c5a2b89

chargome marked this pull request as ready for review February 16, 2026 13:10

github-actionsBot mentioned this pull request Feb 16, 2026
chore(ci): Move monorepo to nx #19340
Closed

cursorBot reviewed Feb 16, 2026
View reviewed changes

Comment thread.github/workflows/build.yml

chargome added 2 commits February 16, 2026 14:19

create version detection file
44a9023

fmt
c83d7df

cursorBot reviewed Feb 16, 2026
View reviewed changes

Comment threadpackage.json
Comment threadscripts/bump-version.js Outdated

chargome added 2 commits February 16, 2026 14:31

make job required
8ef6313

throw on partial updates
e3256fc

chargome requested review from JPeer264, Lms24 and andreiborza February 16, 2026 14:31

move test to vitest
42703c2

sentryBot reviewed Feb 16, 2026
View reviewed changes

Comment threadpackage.json

This was referenced Mar 9, 2026
chore(deps): update dependency @sentry/react to v10.42.0 6g0kwtm3/animini-monorepo#1476
Merged
Update sentry-javascript monorepo to v10.55.0 ioos/buoy_retriever#133
Open

konflux-stagingBot mentioned this pull request Mar 10, 2026
chore(deps): update dependency @sentry/react to v10.43.0 testcara/konflux-ui#124
Open
1 task

This was referenced Mar 10, 2026
Update dependency @sentry/browser to v10.40.0 naymspace/backpex#1863
Merged
chore(deps): update dependency @sentry/react to v10.43.0 giantswarm/backstage#1361
Merged

github-actionsBot mentioned this pull request Mar 11, 2026
chore(deps): update JavaScript SDK to v10.49.0 glemartret/sentry-dart#1
Open

This was referenced Mar 21, 2026
Update dependency @sentry/node to v10 sderickson/saflib#230
Merged
chore(deps): update dependency @sentry/nextjs to v10.46.0 m1m0zzz/visualizers#16
Merged
chore(deps): update all non-major dependencies MooncellWiki/prts-widgets#286
Merged

red-hat-konfluxBot mentioned this pull request Mar 24, 2026
fix(deps): update dependency @sentry/browser to v10 RedHatInsights/uhc-portal#413
Closed
1 task

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script getsentry/rrweb#272
Merged

konflux-stagingBot mentioned this pull request Apr 1, 2026
chore(deps): update dependency @sentry/react to v10.50.0 testcara/konflux-ui-test#53
Open
1 task

renovateBot mentioned this pull request Apr 2, 2026
fix(deps): update dependency @sentry/sveltekit to ^10.45.0 Seenivers/App#612
Merged
1 task