Walkthrough

Widened @sentry/node peer range, replaced a Sentry type import with a derived parameter type, added two test comments about Sentry v10 behavior, added advisory metadata to root package.json, and updated CHANGELOG with a Pro Unreleased entry. No runtime logic changes.

Changes

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related issues

• Support Sentry SDK v9/10 in Node Renderer #2294: Implements requested support for newer Sentry SDK versions by widening the peer range and adjusting Sentry-related types.

Poem

🐰 Hopping through changelogs, light and spry,
I nudged the ranges, let old bounds fly,
Types now follow where startSpan goes,
A tiny note where test wind blows,
Pro rabbit cheers — release we try!

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Greptile Summary

This PR updates Sentry SDK compatibility from v7-v8 to v5-v10 by replacing the direct @sentry/types import with a type extraction pattern using Parameters<typeof Sentry.startSpan>[0]. This approach avoids the dependency issue where @sentry/types is no longer a transitive dependency of @sentry/node in v9+.

Key changes:

• Type extraction using Parameters utility type eliminates need for @sentry/types import
• Peer dependency range widened to >=5.0.0 <11.0.0 to support v9 and v10
• Test assertion documented as needing removal when devDependency is upgraded to v10
• Root package.json documents why Sentry devDependency must stay at v7 (to avoid breaking sentry6 integration)

The approach is clean and maintains type safety without introducing additional dependencies.

Confidence Score: 5/5

• Safe to merge - clean backward-compatible type extraction pattern with proper documentation
• The changes use TypeScript's built-in Parameters utility type to extract the correct type from the Sentry SDK API, which is a robust approach that will work across all supported Sentry versions. The peer dependency range is appropriately widened, and important constraints are documented in comments. Tests pass with current v7 and were manually verified with v10.
• No files require special attention

Important Files Changed

Flowchart

flowchart TD
    A[Sentry Integration v7-v8] --> B{Type Dependency Issue}
    B --> C[sentry/types no longer transitive in v9+]
    C --> D[Solution: Type Extraction]
    D --> E[Parameters typeof Sentry.startSpan]
    E --> F[UnitOfWorkOptions Interface]
    F --> G[Supports Sentry v5-v10]
    
    H[Peer Dependency] --> I[Update range to v5-v10]
    I --> G
    
    J[Root package.json] --> K[Keep devDep at v7]
    K --> L[Prevents breaking sentry6 integration]

_{Last reviewed commit: aee5fde}

size-limit report 📦

PR Review: Support Sentry SDK v9 and v10 in node renderer integration

Overall this is a clean, well-scoped change. The approach is sound and the breadth of the diff is appropriately minimal.

What's good

• Type extraction pattern — Replacing the explicit StartSpanOptions import with Parameters<typeof Sentry.startSpan>[0] is the idiomatic solution here. It derives the type directly from the function signature, so it stays in sync automatically when Sentry updates its API, and avoids the transitive-dep problem entirely.

• Graceful runtime check for older Fastify API — The existing 'setupFastifyErrorHandler' in Sentry check in sentry.ts already handles version branching cleanly, and the widened peer dep is consistent with that pattern.

• package.json comment — Adding an explanatory comment about the Sentry v7 devDependency cap is helpful; it prevents a future contributor from innocently bumping the version and breaking the sentry6 integration type-check.

• CHANGELOG placement — Correctly filed under "Fixed" before "Changed".

Observation: test comment is fragile future-debt

The comment added to tracing.test.ts is well-intentioned but easy to miss:

// Note: Sentry v10 no longer sets report.tags.transaction automatically.
// Remove this assertion when upgrading devDependency.
expect(report.tags.transaction).toBe(spanName);

Since the PR description says this assertion will fail when the devDependency is upgraded to v10, and there's no linked issue or TODO tracker, it's likely to surface as a confusing test failure in the future. Consider opening a GitHub issue for tracking the devDependency upgrade and referencing it in the comment (e.g. // TODO: remove when upgrading @sentry/node devDep (see #XXXX)), or file a follow-up issue immediately.

Minor: lower peer-dep bound may be over-broad (pre-existing)

The @sentry/node peer dep lower bound >=5.0.0 predates this PR, but is worth flagging since Sentry.startSpan wasn't introduced until v7.99+. A user on v5 or v6 who installs react-on-rails-pro-node-renderer and uses the sentry.ts integration would hit a runtime crash — the type system can't catch this because Parameters<typeof Sentry.startSpan>[0] resolves at compile time against whatever version is installed. Not a blocker for this PR since it's a pre-existing issue, but worth tracking.

Summary

The core change is correct and elegantly minimal. No blockers — the observations above are improvements to consider as follow-ups.