@sentry/tanstackstart-react: vite-plugin should not be a runtime dependency

[tttc6]

Problem

@sentry/tanstackstart-react@10.39.0 includes @sentry/vite-plugin as a runtime dependency, causing ERR_MODULE_NOT_FOUND errors in production when using pnpm for deployment.

Expected Behavior

Build-time tools like Vite plugins should be:

• Listed as peerDependencies in the framework SDK (optional)
• Installed as devDependencies by the user
• Never included as runtime dependencies

This is the pattern used by other framework integrations and documented in Sentry's own bundler plugin documentation.

Actual Behavior

// @sentry/tanstackstart-react@10.39.0/package.json
{
  "dependencies": {
    "@sentry/vite-plugin": "^4.8.0"  // ← WRONG
  }
}

This pulls @sentry/bundler-plugin-core and @babel/core (+ ~50 Babel plugins) into production bundles.

Runtime Errors in Production

When deployed with pnpm, these packages aren't hoisted by default, causing:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@babel/core' 
imported from /app/.output/server/node_modules/@sentry/bundler-plugin-core/dist/esm/index.mjs

Similar errors occur for:

• @opentelemetry/instrumentation
• Various @sentry/* and @babel/* packages

Reproduction

1. Create TanStack Start app with @sentry/tanstackstart-react@10.39.0
2. Deploy using pnpm deploy --prod (or any pnpm-based deployment)
3. Run the deployed app
4. Observe runtime import errors

Environment

• Package: @sentry/tanstackstart-react@10.39.0
• Runtime: Node.js production deployment (Docker, serverless, etc.)
• Package Manager: pnpm v10 (with default hoisting behavior)
• Framework: TanStack Start v1.160.0

Workaround

Add to .npmrc:

public-hoist-pattern[]=*@opentelemetry/*
public-hoist-pattern[]=*@sentry/*
public-hoist-pattern[]=*@babel/*

This forces pnpm to hoist these packages, but has significant drawbacks:

• Security: Bundles ~5-10MB of build tools in production
• Performance: Extra memory overhead and slower cold starts
• Bundle size: Babel + plugins unnecessarily inflates deployments

Requested Fix

Remove @sentry/vite-plugin from dependencies in @sentry/tanstackstart-react/package.json:

{
- "dependencies": {
-   "@sentry/vite-plugin": "^4.8.0"
- },
+ "peerDependencies": {
+   "@sentry/vite-plugin": "^4.8.0"
+ },
+ "peerDependenciesMeta": {
+   "@sentry/vite-plugin": {
+     "optional": true
+   }
+ }
}

And update documentation to have users install @sentry/vite-plugin as a devDependency.

Similar Issues

This is the exact same problem that exists with other framework SDKs:

• Deployment on Netlify using SvelteKit succeeding during build but failing during requests (Cannot find module '@sentry/bundler-plugin-core/sentry-release-injection-file') #9544 - @sentry/sveltekit with Netlify deployments
• Both cases: bundler plugins incorrectly bundled as runtime dependencies

Additional Context

• Latest version checked: @sentry/tanstackstart-react@10.39.0 (2026-02-16)
• Issue persists across all 10.x versions
• Affects any deployment using pnpm or strict dependency managers
• Workaround reference: sortie-code/sortie@9ca8966

Build tools should never be runtime dependencies. This packaging bug:

1. Violates npm/pnpm best practices
2. Creates security surface area (unnecessary code in production)
3. Degrades performance (bundle bloat, memory overhead)
4. Breaks deployments with proper dependency isolation

Please consider fixing this packaging issue to align with other Sentry framework SDKs and standard npm practices.

[linear]

JS-1733

[tttc6]

Sorry for the Claude-ness of this issue description - I mistakenly thought I was opening an issue in my own repo. Given how nice a job he has done of writing this up for you though, I'll let it stand.

Would you recommend migrating to the base node and react packages, given that Tanstack Start is all pretty new?