Missing `@opentelemetry/instrumentation` dependency during nextjs build

[rchl-u]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/nextjs

SDK Version

10.47.0

Framework Version

Next 16.2.2

Link to Sentry event

No response

Reproduction Example/SDK Setup

No response

Steps to Reproduce

1. Install @sentry/nextjs in a monorepo project where multiple packages use @sentry/nextjs.
2. Build Next

Expected Result

Required dependencies being present.

Actual Result

> Build error occurred
Error: Cannot find module '@opentelemetry/instrumentation'
Require stack:
- /project/node_modules/@sentry/node-core/build/cjs/otel/instrument.js
- /project/node_modules/@sentry/node-core/build/cjs/integrations/http/index.js
- /project/node_modules/@sentry/node-core/build/cjs/index.js
- /project/node_modules/@sentry/node/build/cjs/integrations/http.js
- /project/node_modules/@sentry/node/build/cjs/index.js
- /project/node_modules/@sentry/nextjs/build/cjs/config/withSentryConfig/getFinalConfigObjectUtils.js
- /project/node_modules/@sentry/nextjs/build/cjs/config/withSentryConfig/getFinalConfigObject.js
- /project/node_modules/@sentry/nextjs/build/cjs/config/withSentryConfig/index.js
- /project/node_modules/@sentry/nextjs/build/cjs/index.server.js
- /project/apps/app-name/next.config.compiled.js
- /project/node_modules/next/dist/build/next-config-ts/transpile-config.js
- /project/node_modules/next/dist/server/config.js
- /project/node_modules/next/dist/cli/next-test.js
- /project/node_modules/next/dist/bin/next

Additional Context

I did not make reproduction for this because it would take too much time to figure out how to reproduce it with minimal project but I think the require stack shows that there is problem with dependency setup in sentry packages.

It obviously involves a monorepo with additional packages that also use @sentry/nextjs or even @opentelemetry to trigger npm into certain dependency layout when it comes to ``@opentelemetry/*` dependencies.

Why I think it's a problem with sentry packages is because @sentry/node-core explicitly imports @opentelemetry/instrumentation but doesn't have it in its dependencies.

Yes, It does specify it in peerDependencies but that doesn't really do anything automatically (not with npm at least). It's just an indication that the user of this package should install those dependencies. But there is no indication anywhere in the documentation that those packages should be explicitly installed.

I see how having those as explicit dependencies might not be ideal since it's a shared core package and not every user of it should need those but it's npm and I think a choice has to be made - correct dependency tree and corresponding bloat or random errors like that.

Priority

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.}

[linear-code]

JS-2109

[rchl-u]

To add more context...

I'm dealing with a monorepo and this case triggers because npm decided to place @opentelemetry/instrumentation in specific packages due to conflicting versions but there is no copy of it in that specific package that fails because there are no explicit dependencies on it in @sentry/nextjs or any of its dependencies.

[s1gr1d]

Hello and thanks for writing in!
First, it's a peer dependency in @sentry/node-core because this package has the sub-export @sentry/node-core/light (Docs for lightweight mode) for users with existing OpenTelemetry setups.

@sentry/nextjs depends on @sentry/node which lists all @opentelemetry/... dependencies. So in theory, you should get the dependency through @sentry/node.

However, the dependency resolution might go "wrong" when the package manager detects different versions (especially in the monorepo case). But I agree that this is cumbersome. We might need to explicitly declare @opentelemetry/instrumentation as a dependency in the consumer packages like @sentry/nextjs.

Are you using different versions of Sentry in the monorepo? You might be able to fix this yourself by using the same version everywhere or adding a version override for the OpenTelemetry dependency, so all packages use the same dependency.

[rchl-u]

All versions of @sentry/nextjs in my project are the same but that still includes different versions of @opentelemetry/instrumentation. It looks like I can fix those issues by triggering dedupe or updating some older versions in the lock file but the point of this issue was to raise the problem that can happen depending on npm's mood.

@sentry/nextjs depends on @sentry/node which lists all @opentelemetry/... dependencies. So in theory, you should get the dependency through @sentry/node.

I wish it would be the case but I think this issue shows that it doesn't.

I don't think there is any good and detailed documentation for NPM's peerDependencies behavior but I feel like those don't apply within intrinsic dependencies like those. Neither automatically by NPM enforcing those to be present nor through NPM's warnings when installing dependencies. So pretty sure that installing those explicitly in my project would fix the issue but it kinda defeats the purpose of those being optional.

[s1gr1d]

Yeah I understand the frustration here. Did you already deduplicated your dependencies and did that fix your issue here?
You could also add an override so everything is using the same @opentelemetry/... versions: https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides