feat(bun): Add orchestrion bun build plugin by isaacs · Pull Request #21410 · getsentry/sentry-javascript

isaacs · 2026-06-09T19:23:58Z

Use the orchestrion plugin defined in server-utils, and create a plugin that Bun can use in bun build mode.

Note: this does not provide a plugin for use with bun run, because that feature is blocked by oven-sh/bun#31770

When that issue resolves, we can look into providing this for the bun runtime, likely with a version guard to avoid the footgun of removing CommonJS exports in some cases.

github-actions · 2026-06-09T19:42:14Z

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	27.45 kB	-	-
@sentry/browser - with treeshaking flags	25.88 kB	-	-
@sentry/browser (incl. Tracing)	45.88 kB	-	-
@sentry/browser (incl. Tracing + Span Streaming)	48.11 kB	-	-
@sentry/browser (incl. Tracing, Profiling)	50.65 kB	-	-
@sentry/browser (incl. Tracing, Replay)	85.08 kB	-	-
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	74.68 kB	-	-
@sentry/browser (incl. Tracing, Replay with Canvas)	89.78 kB	-	-
@sentry/browser (incl. Tracing, Replay, Feedback)	102.44 kB	-	-
@sentry/browser (incl. Feedback)	44.62 kB	-	-
@sentry/browser (incl. sendFeedback)	32.25 kB	-	-
@sentry/browser (incl. FeedbackAsync)	37.38 kB	-	-
@sentry/browser (incl. Metrics)	28.52 kB	-	-
@sentry/browser (incl. Logs)	28.76 kB	-	-
@sentry/browser (incl. Metrics & Logs)	29.45 kB	-	-
@sentry/react	29.25 kB	-	-
@sentry/react (incl. Tracing)	48.17 kB	-	-
@sentry/vue	32.56 kB	-	-
@sentry/vue (incl. Tracing)	47.74 kB	-	-
@sentry/svelte	27.48 kB	-	-
CDN Bundle	29.86 kB	-	-
CDN Bundle (incl. Tracing)	48.28 kB	-	-
CDN Bundle (incl. Logs, Metrics)	31.4 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics)	49.58 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics)	70.71 kB	-	-
CDN Bundle (incl. Tracing, Replay)	85.61 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.88 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback)	91.46 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	92.71 kB	-	-
CDN Bundle - uncompressed	88.8 kB	-	-
CDN Bundle (incl. Tracing) - uncompressed	146.04 kB	-	-
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.5 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	150.02 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	218.33 kB	-	-
CDN Bundle (incl. Tracing, Replay) - uncompressed	264.91 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	268.87 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	278.61 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	282.56 kB	-	-
@sentry/nextjs (client)	50.58 kB	-	-
@sentry/sveltekit (client)	46.27 kB	-	-
@sentry/core/server	76.16 kB	-	-
@sentry/core/browser	63.31 kB	-	-
@sentry/node-core	61.87 kB	-0.01%	-1 B 🔽
@sentry/node	127.71 kB	+0.02%	+21 B 🔺
@sentry/node - without tracing	74.23 kB	-0.04%	-29 B 🔽
@sentry/aws-serverless	85.34 kB	-0.01%	-1 B 🔽
@sentry/cloudflare (withSentry) - minified	174.48 kB	-	-
@sentry/cloudflare (withSentry)	436.52 kB	-	-
@sentry/node/import (ESM hook with diagnostics-channel injection)	70.01 kB	added	added
@sentry/node/light	50.92 kB	added	added

View base workflow run

github-actions · 2026-06-12T11:23:41Z

👋 @mydea, @JPeer264 — Please review this PR when you get a chance!

Use the orchestrion plugin defined in server-utils, and create a plugin that Bun can use in `bun build` mode. Note: this does *not* provide a plugin for use with `bun run`, because that feature is blocked by oven-sh/bun#31770 When that issue resolves, we can look into providing this for the bun runtime, likely with a version guard to avoid the footgun of removing CommonJS exports in some cases.

semgrep-code-getsentry · 2026-06-18T04:23:07Z

Semgrep found 1 ssc-d17d3487-883b-46a9-bec9-dee3375f7532 finding:

yarn.lock
- L15987 - Triage

Risk: Affected versions of esbuild are vulnerable to Download of Code Without Integrity Check / Untrusted Search Path. esbuild's Deno distribution module (lib/deno/mod.ts) contains an import.meta.main CLI entrypoint that calls install() directly when the module is run as a script (deno run https://deno.land/x/esbuild@vX/mod.js). This download path has no SHA-256 integrity verification: if NPM_CONFIG_REGISTRY resolves to an attacker-controlled registry, the fetched binary is executed immediately, yielding arbitrary code execution without any API call in user code.

Manual Review Advice: A vulnerability from this advisory is reachable if you invoke the esbuild Deno module directly as a CLI tool (e.g. deno run https://deno.land/x/esbuild@vX/mod.js) and the NPM_CONFIG_REGISTRY environment variable resolves the binary download to an untrusted registry

Fix: Upgrade this library to at least version 0.28.1 at sentry-javascript/yarn.lock:15987.

Reference(s): GHSA-gv7w-rqvm-qjhr

Use the orchestrion plugin defined in server-utils, and create a plugin that Bun can use in `bun build` mode. Note: this does *not* provide a plugin for use with `bun run`, because that feature is blocked by oven-sh/bun#31770 When that issue resolves, we can look into providing this for the bun runtime, likely with a version guard to avoid the footgun of removing CommonJS exports in some cases.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 69a65aa. Configure here.}

cursor · 2026-06-18T04:53:23Z

+
+      // Delegate to the upstream code-transformer, which registers the `onLoad`
+      // hook that does the actual channel injection.
+      transformer.setup(build);


External deps skip instrumentation

Medium Severity

The Bun orchestrion plugin only merges the bundler marker into build.config.banner and never adjusts build.config.external. If a Bun.build call marks an instrumented package such as mysql as external, that dependency is resolved from node_modules at runtime without passing through the transformer's onLoad hook, so diagnostics-channel injection is skipped with no error.

^{Reviewed by Cursor Bugbot for commit 69a65aa. Configure here.}

Use the orchestrion plugin defined in server-utils, and create a plugin that Bun can use in `bun build` mode. Note: this does *not* provide a plugin for use with `bun run`, because that feature is blocked by oven-sh/bun#31770 When that issue resolves, we can look into providing this for the bun runtime, likely with a version guard to avoid the footgun of removing CommonJS exports in some cases.

sentry · 2026-06-18T14:30:51Z

+// `@apm-js-collab/code-transformer-bundler-plugins/bun` is published ESM-only
+// (no `require` arm, unlike its `/vite` entry). The ESM build imports it; the
+// CJS build requires it. Bun resolves correctly for ESM modules in either
+// module system.
+import codeTransformer from '@apm-js-collab/code-transformer-bundler-plugins/bun';
+import { SENTRY_INSTRUMENTATIONS } from '@sentry/server-utils/orchestrion/config';


Bug: The CJS build of the plugin attempts to require() an ESM-only dependency, which will fail in a Node.js environment.
_{Severity: MEDIUM}

Suggested Fix

Either remove the CJS export for the plugin from package.json to prevent its use in Node.js environments, or replace the static require() with a dynamic import() to correctly load the ESM-only dependency.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: packages/bun/src/plugin.ts#L35-L40 Potential issue: The `@sentry/bun` package publishes both CJS and ESM builds. The CJS build of `plugin.ts` uses `require()` to import the `@apm-js-collab/code-transformer-bundler-plugins/bun` package. However, this dependency is ESM-only and does not provide a CJS entry point. While Bun's runtime can handle this, standard Node.js cannot and will throw an `ERR_REQUIRE_ESM` error. Since the `package.json` exports the CJS build path, any user attempting to use this plugin in a Node.js-based environment (like a CI pipeline running a build script with Node) will encounter a runtime crash when `require('@sentry/bun/plugin')` is executed.

isaacs requested a review from a team as a code owner June 9, 2026 19:23

isaacs requested review from JPeer264 and mydea and removed request for a team June 9, 2026 19:24

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 48fa3e3 to 0157d09 Compare June 9, 2026 19:27

isaacs force-pushed the isaacs/bun-orchestrion branch from 362c870 to 39be3da Compare June 9, 2026 19:28

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 0157d09 to 25bfdaa Compare June 10, 2026 19:33

isaacs force-pushed the isaacs/bun-orchestrion branch from 39be3da to b34aa87 Compare June 10, 2026 19:34

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 25bfdaa to 7a8b730 Compare June 10, 2026 19:37

sentry Bot reviewed Jun 10, 2026

View reviewed changes

Comment thread packages/bun/package.json Outdated

isaacs force-pushed the isaacs/bun-orchestrion branch from b34aa87 to 653fc0e Compare June 10, 2026 20:06

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 7a8b730 to 7b69e3b Compare June 10, 2026 20:07

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch 3 times, most recently from c26138a to a16cf66 Compare June 15, 2026 18:46

isaacs force-pushed the isaacs/bun-orchestrion branch from 653fc0e to 8743326 Compare June 15, 2026 18:48

sentry Bot reviewed Jun 15, 2026

View reviewed changes

Comment thread packages/bun/src/plugin.ts Outdated

cursor Bot reviewed Jun 15, 2026

View reviewed changes

Comment thread packages/bun/src/plugin.ts Outdated

isaacs force-pushed the isaacs/bun-orchestrion branch from b5a794a to ac38662 Compare June 15, 2026 19:00

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from a16cf66 to 5c34ba0 Compare June 15, 2026 19:24

isaacs force-pushed the isaacs/bun-orchestrion branch from ac38662 to 0cfd982 Compare June 15, 2026 19:46

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 5c34ba0 to c433056 Compare June 15, 2026 22:44

isaacs force-pushed the isaacs/bun-orchestrion branch from 0cfd982 to ccbd1b2 Compare June 15, 2026 22:45

JPeer264 approved these changes Jun 16, 2026

View reviewed changes

mydea reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/bun/src/plugin.ts Outdated

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from c433056 to 1551113 Compare June 16, 2026 17:53

isaacs force-pushed the isaacs/bun-orchestrion branch from 33c961c to 58c4c54 Compare June 17, 2026 00:01

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 1551113 to 5551e89 Compare June 17, 2026 01:19

isaacs force-pushed the isaacs/bun-orchestrion branch from 58c4c54 to 942cbc7 Compare June 17, 2026 06:06

isaacs force-pushed the isaacs/bun-orchestrion branch from 942cbc7 to b7d3bf4 Compare June 17, 2026 06:07

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 5551e89 to df94b15 Compare June 17, 2026 06:16

isaacs force-pushed the isaacs/bun-orchestrion branch from b7d3bf4 to 5b4cb48 Compare June 17, 2026 06:16

sentry Bot reviewed Jun 17, 2026

View reviewed changes

Comment thread packages/bun/package.json

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from df94b15 to fa84662 Compare June 17, 2026 06:28

isaacs force-pushed the isaacs/bun-orchestrion branch from 5b4cb48 to cfe1a03 Compare June 17, 2026 06:29

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from fa84662 to 3300ba7 Compare June 18, 2026 04:16

isaacs force-pushed the isaacs/bun-orchestrion branch from cfe1a03 to 568911f Compare June 18, 2026 04:20

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 3300ba7 to c9f3507 Compare June 18, 2026 04:20

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch 3 times, most recently from 7d1f62e to 7323f1a Compare June 18, 2026 04:50

isaacs force-pushed the isaacs/bun-orchestrion branch from 568911f to 69a65aa Compare June 18, 2026 04:51

cursor Bot reviewed Jun 18, 2026

View reviewed changes

isaacs force-pushed the experiment/orchestrionjs-auto-instrumentation branch from 7323f1a to 92b508d Compare June 18, 2026 14:20

isaacs force-pushed the isaacs/bun-orchestrion branch from 69a65aa to ea45a82 Compare June 18, 2026 14:20

isaacs force-pushed the isaacs/bun-orchestrion branch from ea45a82 to 623d0c5 Compare June 18, 2026 14:27

sentry Bot reviewed Jun 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(bun): Add orchestrion bun build plugin#21410

feat(bun): Add orchestrion bun build plugin#21410
isaacs wants to merge 1 commit into
experiment/orchestrionjs-auto-instrumentationfrom
isaacs/bun-orchestrion

isaacs commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

semgrep-code-getsentry Bot commented Jun 18, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 18, 2026

Uh oh!

sentry Bot Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

isaacs commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

Uh oh!

github-actions Bot commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

semgrep-code-getsentry Bot commented Jun 18, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 18, 2026

Choose a reason for hiding this comment

External deps skip instrumentation

Uh oh!

sentry Bot Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Jun 9, 2026 •

edited

Loading