chore: Move the monorepo from Yarn 1 to pnpm

[JPeer264]

This moves the monorepo from Yarn 1 to pnpm 9.15.9 (pinned in Volta): scripts, CI workflows, the release script and the contributor docs. Most of the added lines are pnpm-lock.yaml, which has the same versions as the current yarn.lock except for a few that pnpm dedupe merged.

Changes beyond the rename:

• @sentry/nitro and @sentry/nuxt declare h3 and unstorage, which they imported without a declaration.
• @sentry/server-runtime-injection vendors the Node build of supports-color instead of the browser build.
• The Lambda layer build no longer writes through pnpm's hard links into packages/core/build.

Install layout decisions

.npmrc sets node-linker=hoisted and auto-install-peers=false, so pnpm installs the same flat node_modules as Yarn 1. The isolated pnpm default would need every package to declare all its imports.

Workspace decisions

All workspace packages are root devDependencies (workspace:*), because some configs import workspace packages without declaring them. The workspaces list stays in package.json for Deno, and verify-packages-versions.js checks that it matches pnpm-workspace.yaml.

Known issues

• Contributors need VOLTA_FEATURE_PNPM=1 and a fresh install (pnpm clean:deps).
• The release and canary workflows did not run on this branch. Only a local simulation of the version bump ran.

[semgrep-code-getsentry]

Semgrep found 2 ssc-9e16049c-d627-4ef3-9759-3139101c4fa9 findings:

• pnpm-lock.yaml
  • L3655 - Triage
  • L3658 - Triage

🟡 Medium severity issue identified in your code:

Risk: Affected versions of @babel/helpers, @babel/runtime, @babel/runtime-corejs2, and @babel/runtime-corejs3 are vulnerable to Inefficient Regular Expression Complexity. Babel generates a polyfill (the wrapRegExp helper) for String.prototype.replace on regular expressions with named capturing groups that has quadratic (ReDoS) complexity when an untrusted replacement string containing the substring $< is processed. The vulnerable code is generated polyfill code rather than a symbol you call directly, so any project transpiling named capturing groups against affected browser targets is at risk. Upgrade to a patched version and recompile your code to remediate.

Fix: Upgrade this library to at least version 7.26.10 at sentry-javascript/pnpm-lock.yaml:3658.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7806, GHSA-968p-4wvh-cqc8, CVE-2025-27789

Semgrep found 3 ssc-90df8fd1-2d4f-4e7b-a8aa-dfa15f51f5bf findings:

• pnpm-lock.yaml
  • L11477 - Triage
  • L11482 - Triage
  • L11487 - Triage

🟡 Medium severity issue identified in your code:

Risk: Affected versions of esbuild are vulnerable to Origin Validation Error. esbuild's development server responds to every request, including Server-Sent Events connections, with Access-Control-Allow-Origin: *. Any website a developer visits can therefore make cross-origin requests to the local dev server and read the responses, leaking bundled source code, source maps, and served file paths. Starting the dev server via serve() reaches the vulnerable code path.

Manual Review Advice: A vulnerability from this advisory is reachable if you run esbuild with the --serve flag to start the development server

Fix: Upgrade this library to at least version 0.25.0 at sentry-javascript/pnpm-lock.yaml:11487.

Reference(s): GHSA-67mh-4wv8-2f99

Semgrep found 1 ssc-14373fcb-6df6-4a88-a68b-95bf4fdd53ad finding:

• pnpm-lock.yaml
  • L13255 - Triage

🟡 Medium severity issue identified in your code:

Risk: Affected versions of jsondiffpatch are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). jsondiffpatch renders JSON object keys into HTML without escaping in its HTML formatter (HtmlFormatter / format). An attacker who controls the JSON being diffed can inject a malicious object key (e.g. a <script> tag) that executes in the context of the consuming web page (DOM-based XSS).

Manual Review Advice: A vulnerability from this advisory is reachable if you are uisng jsondiffpatch on the CLI

Fix: Upgrade this library to at least version 0.7.2 at sentry-javascript/pnpm-lock.yaml:13255.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27629, GHSA-33vc-wfww-vjfv, CVE-2025-9910

Semgrep found 2 ssc-609dd635-87fa-44a8-af18-b6e58a147de0 findings:

• pnpm-lock.yaml
  • L17278 - Triage
  • L17282 - Triage

🟡 Medium severity issue identified in your code:

Risk: Affected versions of svelte are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Svelte versions before 4.2.19 improperly escape HTML during server-side rendering (SSR): attribute values only escape & and " but not <. A user-controlled value placed in an element attribute inside a <noscript> element can break out of the attribute/noscript context and inject markup, resulting in cross-site scripting (XSS).

Manual Review Advice: A vulnerability from this advisory is reachable if you use Svelte server-side rendering with a component that places user-controlled data in an element attribute inside a <noscript> element

Fix: Upgrade this library to at least version 4.2.19 at sentry-javascript/pnpm-lock.yaml:17282.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2530, GHSA-8266-84wp-wv5c, CVE-2024-45047

Semgrep found 1 ssc-484bb776-a960-4899-8ddd-675885fe6a95 finding:

• pnpm-lock.yaml
  • L18704 - Triage

🟡 Medium severity issue identified in your code:

Risk: Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such <script src> requests bypass the same-origin policy, a malicious website visited by a developer running the dev server can load the application bundle cross-origin and, via prototype pollution of the webpack runtime, extract the application source code.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using webpack dev server CLI setup

Fix: Upgrade this library to at least version 5.2.1 at sentry-javascript/pnpm-lock.yaml:18704.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16767, GHSA-4v9v-hfq4-rm2v, CVE-2025-30359

Semgrep found 1 ssc-013ecbde-4597-4af3-bcc3-06920828d5cc finding:

• pnpm-lock.yaml
  • L18704 - Triage

🟡 Medium severity issue identified in your code:

Risk: Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using webpack dev server CLI setup and access untrusted web site with non-Chromium based browser

Fix: Upgrade this library to at least version 5.2.1 at sentry-javascript/pnpm-lock.yaml:18704.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16764, GHSA-9jgg-88mc-972h, CVE-2025-30360

Semgrep found 1 ssc-f748ff04-95cd-4e1a-8429-2525a723a048 finding:

• pnpm-lock.yaml
  • L18756 - Triage

🟡 Medium severity issue identified in your code:

Risk: Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. ), an attacker who can inject markup into the page can redirect dynamic chunk/asset loading to an attacker-controlled origin, resulting in cross-site scripting (XSS).

Manual Review Advice: A vulnerability from this advisory is reachable if you build with output.publicPath unset

Fix: Upgrade this library to at least version 5.94.0 at sentry-javascript/pnpm-lock.yaml:18756.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2497, GHSA-4vvj-4cpr-p986, CVE-2024-43788

Semgrep found 2 ssc-e4c0f25b-1e41-443a-9b72-0fd356011bb1 findings:

• pnpm-lock.yaml
  • L16762 - Triage
  • L16766 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component / Use After Free. The prebuilt libvips binaries shipped with sharp bundle a vulnerable librsvg that has a use-after-free when decoding SVG images, which can lead to remote code execution when sharp processes an attacker-supplied SVG. Upgrade to sharp 0.35.5 or later, or block SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }).

Manual Review Advice: A vulnerability from this advisory is reachable if you decode SVG input with sharp, which is enabled by default, and have not disabled it with sharp.block({ operation: ["VipsForeignLoadSvg"] })

Fix: Upgrade this library to at least version 0.35.5 at sentry-javascript/pnpm-lock.yaml:16766.

Reference(s): GHSA-wq5f-xc86-pv6w

Semgrep found 2 ssc-0c6b5f0e-7d1a-4e5b-9a43-2f8d6b1c7e94 findings:

• pnpm-lock.yaml
  • L18692 - Triage
  • L18698 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of webpack-dev-middleware are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). When publicPath has no trailing slash (e.g. /assets), a request such as /assets../secret passes the path traversal check before the prefix is stripped, letting an unauthenticated attacker read files outside the output directory served by webpack-dev-middleware. Upgrade, or add a trailing slash to publicPath.

Fix: Upgrade this library to at least version 7.4.6 at sentry-javascript/pnpm-lock.yaml:18698.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64850, GHSA-g84c-rxfj-3j2c, GHSA-wr3j-pwj9-hqq6, CVE-2026-76844

Semgrep found 2 ssc-6ff8e141-404b-4098-a03b-5f0ca3015c76 findings:

• pnpm-lock.yaml
  • L2379 - Triage
  • L2388 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's compiler internationalization (i18n) pipeline does not reject static event-handler attributes that are marked for translation with the i18n-on* notation (for example <img src="foo.jpg" onerror="void 0" i18n-onerror />). Angular normally blocks binding to onclick, onerror and similar attributes via validateAttribute()/validateProperty(), but the i18n metadata collection path only rejected Trusted Types sinks, so the handler body is taken from the translation unit instead. A translation file can therefore replace a benign handler with arbitrary JavaScript that executes in the origin of the localized application, leading to session hijacking or actions performed on behalf of the authenticated user.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using Angular's i18n pipeline and also set the matching static on<event> handler attribute on the same element

Fix: Upgrade this library to at least version 20.3.27 at sentry-javascript/pnpm-lock.yaml:2388.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52369, GHSA-jj27-h5hq-8x99

Semgrep found 2 ssc-8ec0dd3e-cfd5-4a9b-9479-f5400432931f findings:

• pnpm-lock.yaml
  • L16762 - Triage
  • L16766 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component. sharp bundles a vulnerable version of the native libvips library, inheriting four memory-safety flaws: an integer overflow leading to a heap-based buffer overflow in the VIPS loader (vipsload, CVE-2026-33327), an integer overflow in the GIF loader (gifload, CVE-2026-33328) causing a denial of service on 32-bit hosts only, a heap-based buffer overflow in the TIFF loader (tiffload, CVE-2026-35591) when handling JPEG or JPEG2000-encoded tiles, and an out-of-bounds read in the EXIF directory decoder (CVE-2026-35590). An attacker who can supply a crafted image can crash the process or corrupt heap memory. Because sharp selects the libvips loader by sniffing the input bytes, no call site can be shown to be safe, and the EXIF flaw is reachable from the JPEG, TIFF, WebP, PNG and HEIF loaders as well. Upgrade to sharp 0.35.0 or later, which bundles libvips 8.18.3. Blocking the affected loaders with sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }) is only a partial stopgap and does not mitigate the EXIF out-of-bounds read (CVE-2026-35590), for which no workaround exists.

Fix: Upgrade this library to at least version 0.35.0 at sentry-javascript/pnpm-lock.yaml:16766.

Reference(s): GHSA-f88m-g3jw-g9cj

Semgrep found 1 ssc-c8b7a1f2-4d36-4f0a-9e2b-1a5c8d7e6f30 finding:

• pnpm-lock.yaml
  • L18334 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like /.env::$DATA?raw, or 8.3 short filenames), allowing an attacker to read otherwise-denied files when the dev server is exposed to the network.

Manual Review Advice: A vulnerability from this advisory is reachable if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows

Fix: Upgrade this library to at least version 6.4.3 at sentry-javascript/pnpm-lock.yaml:18334.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38303, GHSA-fx2h-pf6j-xcff, CVE-2026-53571

Semgrep found 1 ssc-1d4c2f6e-9b3a-4f0c-8d21-6e5a7c0b9f44 finding:

• pnpm-lock.yaml
  • L17659 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of react-router and turbo-stream are vulnerable to Allocation of Resources Without Limits or Throttling. React Router Framework Mode uses turbo-stream to serialize loader/action data into Single Fetch responses. The underlying serialization algorithm becomes a bottleneck on certain data shapes, so an attacker who can influence the serialized data can cause excessive resource consumption and a Denial of Service.

Manual Review Advice: A vulnerability from this advisory is reachable if you use React Router Framework Mode with Single Fetch enabled (the default in v7 Framework Mode, or opt-in via future.unstable_singleFetch in Remix v2.9.0+) and not Declarative or Data mode

Fix: Upgrade this library to at least version 3.0.0 at sentry-javascript/pnpm-lock.yaml:17659.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33994, GHSA-rxv8-25v2-qmq8, CVE-2026-34077

Semgrep found 1 ssc-2427bad3-7619-448f-8f95-70806990606e finding:

• pnpm-lock.yaml
  • L2379 - Triage

🟠 High severity issue identified in your code:

Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the attributeName binding on SVG animation elements (<animate>, <set>, etc.) as requiring strict URL sanitization. An attacker who can supply untrusted input to template bindings like [attr.xlink:href] or <animate [attributeName]="'href'" [values]="maliciousURL"> can inject a javascript: URL payload. When the element is activated (e.g. clicked) or the animation runs, the malicious script executes in the application's origin, enabling session hijacking, data exfiltration, or unauthorized actions.

Manual Review Advice: A vulnerability from this advisory is reachable if you allow SVG/MathML attributes (e.g., xlink:href, href) or to the attributeName field of SVG animation tags (, , etc.) in HTML templates

Fix: Upgrade this library to at least version 19.2.17 at sentry-javascript/pnpm-lock.yaml:2379.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-200118, GHSA-v4hv-rgfq-gp49, CVE-2025-66412

Semgrep found 6 ssc-17eda294-146f-4ed3-91f7-5ef1b349d687 findings:

• pnpm-lock.yaml
  • L2909 - Triage
  • L3545 - Triage
  • L3617 - Triage
  • L9616 - Triage
  • L9636 - Triage
  • L9641 - Triage

🔴 Critical severity issue identified in your code:

Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.

Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript

Fix: There are no safe versions of this library available for upgrade. Library included at sentry-javascript/pnpm-lock.yaml:9641.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2669, GHSA-67hx-6x53-jw92, CVE-2023-45133