@sentry/bundler-plugins pulls @sentry/cli into consumers that only import ./babel-plugin

[friederbluemle]

Summary

@sentry/bundler-plugins declares @sentry/cli as a hard dependency. Consumers that only import the ./babel-plugin entry point pay for a full sentry-cli install, including its platform binary, even though that entry point never invokes the CLI.

Impact

@sentry/react-native 8.21.0 migrated from @sentry/babel-plugin-component-annotate to @sentry/bundler-plugins/babel-plugin (getsentry/sentry-react-native#6501), because the old package is no longer published. It has exactly one import of the package:

// @sentry/react-native/dist/js/tools/sentryBabelTransformerUtils.js
const babel_plugin_1 = require("@sentry/bundler-plugins/babel-plugin");

The ./babel-plugin CJS entry is 20 KB and requires only ./component-annotation.js, ./constants.js and ./experimental.js. It never reaches sentry-cli.

Because @sentry/react-native 8.24.0 pins "@sentry/cli": "3.6.2" while @sentry/bundler-plugins 10.71.0 declares "@sentry/cli": "^2.58.6", package managers install two majors side by side. Measured in a real React Native app on macOS arm64 (Yarn 1.22.22):

	Size
@sentry/cli-darwin@3.6.2 (hoisted)	27 MB
@sentry/cli-darwin@2.58.6 (nested under @sentry/bundler-plugins)	35 MB

• node_modules grew ~36 MB on the 8.18.0 -> 8.24.0 upgrade
• yarn.lock grew 98 net lines, roughly 72 of which are the duplicated @sentry/cli entry plus its eight platform packages

Every clean CI install now downloads both binaries.

Expected

Importing a babel plugin should not install a release-upload CLI.

Suggested fix

Any one of:

• publish the component-annotate babel plugin as a standalone package again
• move @sentry/cli to an optional or peer dependency, so only the bundler integrations that actually shell out to it require it
• split the package so ./babel-plugin resolves without the upload machinery

Workaround

A package manager override pinning @sentry/cli to the version the SDK already uses:

"resolutions": { "@sentry/cli": "3.6.2" }

This removes the duplicate and reduces the lockfile growth from +98 to +26 lines, with no observed breakage, since the babel-plugin path never reaches the CLI.

Versions

• @sentry/bundler-plugins: 10.71.0
• @sentry/react-native: 8.24.0
• react-native: 0.83.10

[linear-code]

JS-3754

[Lms24]

Hey @friederbluemle thanks for writing in! To clarify: Are you experiencing any issues during runtime/in production, or is this request purely about saving install size (in node_modules)? This helps us prioritize a bit.

I don't want to dismiss the issue if it's "just" the latter though. Things change with the upcoming JS SDK major though, because this will flip our bundler plugins to use the new sentry CLI. Hence, updating to v3 of the older @sentry/cli for an "organic" dedupe, is no longer an option.

I will ask the React Native SDK team about their plans of updating the CLI.

Out of the suggested options, 2 and 3 are breaking changes, so that comes a little bit too late for v11 (releasing very soon). Regarding the standalone package, we removed it and inlined it a while ago. We can look into publishing a separate package again but I can't make any promises.