fix: address review comments from Bun→Node migration PRs (#989)

## Summary

Consolidates fixes for review comments across PRs #967, #970, #984,
#986, superseding #988.

### Critical
- **Bump `engines.node` to `>=22.15`** — `node:zlib` zstd APIs require
22.15+. Node 20 is EOL. Updated `dist/bin.cjs` runtime version check to
match.
- **Simplify zstd imports** — replaced feature-detection dance with
direct `import { zstdCompress } from "node:zlib"` now that >=22.15 is
guaranteed.

### High
- **Fix spawn error handling in `upgrade.ts`** — `proc.on("error", () =>
resolve(1))` discarded the error object, making ENOENT/EBUSY detection
dead code. Now properly rejects with the error.

### Medium
- **Fix `sqlite.ts` ROLLBACK** — if ROLLBACK throws, the original
transaction error was lost. Now wrapped in try/catch.
- **Guard `semver.compare`** in `delta-upgrade.ts` with `semver.valid()`
to avoid throwing on invalid version strings.
- **Narrow catch in `shell.ts`** `addToGitHubPath` — only catch ENOENT,
re-throw EACCES/EPERM.
- **Add WriteStream backpressure** in `upgrade.ts`
`streamDecompressToFile` — check `write()` return value, await
`'drain'`.
- **Add `setup-node@v6`** with Node 22 to E2E CI job.

### Low
- **Fix `whichSync` Windows CRLF** — split on `/\r?\n/` instead of `\n`
to strip trailing `\r` from `where.exe` output.

### Test results
All 7014 tests pass, 0 failures.

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: BYK

.github/workflows/ci.yml

@@ -633,6 +633,9 @@ jobs:
         with:
           bun-version: "1.3.13"
       - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
       - uses: actions/cache@v5
         id: cache
         with:

.lore.md

@@ -77,7 +77,7 @@ Credentials are stored in `~/.sentry/` with restricted permissions (mode 600).
 ## Library Usage
 
 <!-- GENERATED:START library-prereq -->
-Use Sentry CLI programmatically in Node.js (≥22.12) or Bun without spawning a subprocess:
+Use Sentry CLI programmatically in Node.js (≥22.15) or Bun without spawning a subprocess:
 <!-- GENERATED:END library-prereq -->
 
 ```typescript

README.md

@@ -63,7 +63,7 @@
   },
   "description": "Sentry CLI - A command-line interface for using Sentry built by robots and humans for robots and humans",
   "engines": {
-    "node": ">=22.12"
+    "node": ">=22.15"
   },
   "files": [
     "dist/bin.cjs",

package.json

@@ -242,7 +242,7 @@ const result = await build({
 // Write the CLI bin wrapper (tiny — shebang + version check + dispatch).
 // Version floor must track `engines.node` in package.json.
 const BIN_WRAPPER = `#!/usr/bin/env node
-{let v=process.versions.node.split(".").map(Number);if(v[0]<22||(v[0]===22&&v[1]<12)){console.error("Error: sentry requires Node.js 22.12 or later (found "+process.version+").\\n\\nEither upgrade Node.js, or install the standalone binary instead:\\n  curl -fsSL https://cli.sentry.dev/install | bash\\n");process.exit(1)}}
+{let v=process.versions.node.split(".").map(Number);if(v[0]<22||(v[0]===22&&v[1]<15)){console.error("Error: sentry requires Node.js 22.15 or later (found "+process.version+").\\n\\nEither upgrade Node.js, or install the standalone binary instead:\\n  curl -fsSL https://cli.sentry.dev/install | bash\\n");process.exit(1)}}
 {let e=process.emit;process.emit=function(n,...a){return n==="warning"?!1:e.apply(this,[n,...a])}}
 require('./index.cjs')._cli().catch(()=>{process.exitCode=1});
 `;

script/bundle.ts

@@ -431,9 +431,9 @@ async function spawnWithRetry(
         stdio: ["ignore", "inherit", "inherit"],
         env,
       });
-      return await new Promise<number>((resolve) => {
+      return await new Promise<number>((resolve, reject) => {
         proc.on("close", (code) => resolve(code ?? 1));
-        proc.on("error", () => resolve(1));
+        proc.on("error", (err) => reject(err));
       });
     } catch (error) {
       // Translate the opaque Bun "Executable not found" error into an

src/commands/cli/upgrade.ts

@@ -24,8 +24,11 @@ import { open, readFile, stat, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
-// biome-ignore lint/performance/noNamespaceImport: needed for feature-detected zstd access
-import * as zlib from "node:zlib";
+import {
+  gzip as gzipCb,
+  constants as zlibConstants,
+  zstdCompress as zstdCompressCb,
+} from "node:zlib";
 import pLimit from "p-limit";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
@@ -35,22 +38,8 @@ import { getSdkConfig } from "../sentry-client.js";
 import { type ZipCompression, ZipWriter } from "../sourcemap/zip.js";
 import { apiRequestToRegion } from "./infrastructure.js";
 
-const gzipAsync = promisify(zlib.gzip);
-// zstdCompress is available in Node 22.15+. Feature-detect to avoid crashing
-// the npm bundle on older Node versions (e.g., CI runners with Node 20).
-// zstdCompress is available in Node 22.15+. Feature-detect to avoid crashing
-// the npm bundle on older Node versions (e.g., CI runners with Node 20).
-// biome-ignore lint/suspicious/noExplicitAny: zstd types unavailable on older @types/node
-const zstdCompressFn = (zlib as any).zstdCompress as
-  | ((...args: unknown[]) => unknown)
-  | undefined;
-const zstdCompressAsync =
-  typeof zstdCompressFn === "function"
-    ? (promisify(zstdCompressFn) as (
-        buf: Buffer,
-        opts?: unknown
-      ) => Promise<Buffer>)
-    : undefined;
+const gzipAsync = promisify(gzipCb);
+const zstdCompressAsync = promisify(zstdCompressCb);
 const log = logger.withTag("api.sourcemaps");
 
 // ── Schemas ─────────────────────────────────────────────────────────
@@ -219,13 +208,13 @@ export async function encodeChunk(
   buf: Buffer,
   encoding: UploadEncoding | undefined
 ): Promise<Uint8Array> {
-  if (encoding === "zstd" && zstdCompressAsync) {
+  if (encoding === "zstd") {
     // L3 is libzstd's default; passed explicitly for self-documenting
     // code. L9+ trades ~14% size for 4x compress time and forces the
     // server's decoder to allocate 15-30 MiB of window state -- not
     // worth it once decode cost is counted.
     return await zstdCompressAsync(buf, {
-      params: { [zlib.constants.ZSTD_c_compressionLevel]: 3 },
+      params: { [zlibConstants.ZSTD_c_compressionLevel]: 3 },
     });
   }
   if (encoding === "gzip") {

src/lib/api/sourcemaps.ts

@@ -139,7 +139,11 @@ export class Database {
         this.db.exec("COMMIT");
         return result;
       } catch (error) {
-        this.db.exec("ROLLBACK");
+        try {
+          this.db.exec("ROLLBACK");
+        } catch (rollbackError) {
+          log.debug("ROLLBACK failed after transaction error", rollbackError);
+        }
         throw error;
       }
     };

src/lib/db/sqlite.ts

@@ -21,7 +21,7 @@ import { unlinkSync } from "node:fs";
 
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
-import { compare as semverCompare } from "semver";
+import { compare as semverCompare, valid as semverValid } from "semver";
 
 import {
   GITHUB_RELEASES_URL,
@@ -460,10 +460,17 @@ export function filterAndSortChainTags(
   currentVersion: string,
   targetVersion: string
 ): string[] {
+  if (!(semverValid(currentVersion) && semverValid(targetVersion))) {
+    return [];
+  }
+
   const chainTags: { tag: string; version: string }[] = [];
 
   for (const tag of allTags) {
     const version = tag.slice(PATCH_TAG_PREFIX.length);
+    if (!semverValid(version)) {
+      continue;
+    }
     // Include tags where: currentVersion < version <= targetVersion
     if (
       semverCompare(version, currentVersion) === 1 &&

src/lib/delta-upgrade.ts

@@ -8,8 +8,11 @@
 import { existsSync } from "node:fs";
 import { access, readFile, writeFile } from "node:fs/promises";
 import { basename, delimiter, join } from "node:path";
+import { logger } from "./logger.js";
 import { whichSync } from "./which.js";
 
+const log = logger.withTag("shell");
+
 /** Supported shell types */
 export type ShellType = "bash" | "zsh" | "fish" | "sh" | "ash" | "unknown";
 
@@ -299,7 +302,12 @@ export async function addToGitHubPath(
     let content = "";
     try {
       content = await readFile(env.GITHUB_PATH, "utf-8");
-    } catch {
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== "ENOENT") {
+        log.debug(`Failed to read GITHUB_PATH (${code}):`, error);
+        return false;
+      }
       // File doesn't exist yet — start with empty content
     }
 
@@ -310,7 +318,8 @@ export async function addToGitHubPath(
       await writeFile(env.GITHUB_PATH, newContent, "utf-8");
     }
     return true;
-  } catch {
+  } catch (error) {
+    log.debug("Failed to update GITHUB_PATH:", error);
     return false;
   }
 }