@sentry/bundler-plugins pulls @sentry/cli into consumers that only import ./babel-plugin

Start with the @sentry/bundler-plugins ./babel-plugin entry point and its component-annotation.js, constants.js, and experimental.js dependencies. Inspect how @sentry/cli is declared and which bundler integrations invoke it. Done means importing only ./babel-plugin no longer installs a duplicate release-upload CLI, while integrations that use the CLI still work; verify with a clean package-manager install and relevant tests.

Summary

@sentry/bundler-plugins declares @sentry/cli as a hard dependency. Consumers that only import the ./babel-plugin entry point pay for a full sentry-cli install, including its platform binary, even though that entry point never invokes the CLI.

Impact

@sentry/react-native 8.21.0 migrated from @sentry/babel-plugin-component-annotate to @sentry/bundler-plugins/babel-plugin (getsentry/sentry-react-native#6501), because the old package is no longer published. It has exactly one import of the package:

// @sentry/react-native/dist/js/tools/sentryBabelTransformerUtils.js
const babel_plugin_1 = require("@sentry/bundler-plugins/babel-plugin");

The ./babel-plugin CJS entry is 20 KB and requires only ./component-annotation.js, ./constants.js and ./experimental.js. It never reaches sentry-cli.

Because @sentry/react-native 8.24.0 pins "@sentry/cli": "3.6.2" while @sentry/bundler-plugins 10.71.0 declares "@sentry/cli": "^2.58.6", package managers install two majors side by side. Measured in a real React Native app on macOS arm64 (Yarn 1.22.22):

• node_modules grew ~36 MB on the 8.18.0 -> 8.24.0 upgrade
• yarn.lock grew 98 net lines, roughly 72 of which are the duplicated @sentry/cli entry plus its eight platform packages

Every clean CI install now downloads both binaries.

Expected

Importing a babel plugin should not install a release-upload CLI.

Suggested fix

Any one of:

• publish the component-annotate babel plugin as a standalone package again
• move @sentry/cli to an optional or peer dependency, so only the bundler integrations that actually shell out to it require it
• split the package so ./babel-plugin resolves without the upload machinery

Workaround

A package manager override pinning @sentry/cli to the version the SDK already uses:

"resolutions": { "@sentry/cli": "3.6.2" }

This removes the duplicate and reduces the lockfile growth from +98 to +26 lines, with no observed breakage, since the babel-plugin path never reaches the CLI.

Versions

• @sentry/bundler-plugins: 10.71.0
• @sentry/react-native: 8.24.0
• react-native: 0.83.10