fix: address review comments from Bun→Node migration PRs

Consolidates fixes for review comments across PRs #967, #970, #984, #986.

Changes:
- Bump engines.node from >=22.12 to >=22.15 (zstd APIs require 22.15+,
  Node 20 is EOL). Update dist/bin.cjs runtime version check to match.
- Simplify zstd imports: replace feature-detection dance with direct
  imports from node:zlib now that >=22.15 is guaranteed.
- Fix spawn error handling in upgrade.ts: propagate error object to catch
  block so ENOENT/EBUSY detection works (was silently resolving with 1).
- Fix sqlite.ts transaction(): wrap ROLLBACK in try/catch so original
  error is preserved if ROLLBACK itself fails.
- Guard semver.compare calls in delta-upgrade.ts with semver.valid() to
  avoid throwing on invalid version strings.
- Narrow catch in shell.ts addToGitHubPath to ENOENT only, re-throw
  other errors (EACCES, EPERM) instead of silently swallowing.
- Add WriteStream backpressure handling in upgrade.ts
  streamDecompressToFile: check write() return value, await drain.
- Add setup-node@v6 with Node 22 to E2E CI job.
- Fix whichSync Windows CRLF: split on /\r?\n/ instead of \n.

7014 tests pass, 0 failures.

Author: BYK

.github/workflows/ci.yml

@@ -633,6 +633,9 @@ jobs:
         with:
           bun-version: "1.3.13"
       - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
       - uses: actions/cache@v5
         id: cache
         with:

.lore.md

@@ -63,7 +63,7 @@
   },
   "description": "Sentry CLI - A command-line interface for using Sentry built by robots and humans for robots and humans",
   "engines": {
-    "node": ">=22.12"
+    "node": ">=22.15"
   },
   "files": [
     "dist/bin.cjs",

package.json

@@ -242,7 +242,7 @@ const result = await build({
 // Write the CLI bin wrapper (tiny — shebang + version check + dispatch).
 // Version floor must track `engines.node` in package.json.
 const BIN_WRAPPER = `#!/usr/bin/env node
-{let v=process.versions.node.split(".").map(Number);if(v[0]<22||(v[0]===22&&v[1]<12)){console.error("Error: sentry requires Node.js 22.12 or later (found "+process.version+").\\n\\nEither upgrade Node.js, or install the standalone binary instead:\\n  curl -fsSL https://cli.sentry.dev/install | bash\\n");process.exit(1)}}
+{let v=process.versions.node.split(".").map(Number);if(v[0]<22||(v[0]===22&&v[1]<15)){console.error("Error: sentry requires Node.js 22.15 or later (found "+process.version+").\\n\\nEither upgrade Node.js, or install the standalone binary instead:\\n  curl -fsSL https://cli.sentry.dev/install | bash\\n");process.exit(1)}}
 {let e=process.emit;process.emit=function(n,...a){return n==="warning"?!1:e.apply(this,[n,...a])}}
 require('./index.cjs')._cli().catch(()=>{process.exitCode=1});
 `;

script/bundle.ts

@@ -431,9 +431,9 @@ async function spawnWithRetry(
         stdio: ["ignore", "inherit", "inherit"],
         env,
       });
-      return await new Promise<number>((resolve) => {
+      return await new Promise<number>((resolve, reject) => {
         proc.on("close", (code) => resolve(code ?? 1));
-        proc.on("error", () => resolve(1));
+        proc.on("error", (err) => reject(err));
       });
     } catch (error) {
       // Translate the opaque Bun "Executable not found" error into an

src/commands/cli/upgrade.ts

@@ -24,8 +24,11 @@ import { open, readFile, stat, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
-// biome-ignore lint/performance/noNamespaceImport: needed for feature-detected zstd access
-import * as zlib from "node:zlib";
+import {
+  gzip as gzipCb,
+  constants as zlibConstants,
+  zstdCompress as zstdCompressCb,
+} from "node:zlib";
 import pLimit from "p-limit";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
@@ -35,22 +38,8 @@ import { getSdkConfig } from "../sentry-client.js";
 import { type ZipCompression, ZipWriter } from "../sourcemap/zip.js";
 import { apiRequestToRegion } from "./infrastructure.js";
 
-const gzipAsync = promisify(zlib.gzip);
-// zstdCompress is available in Node 22.15+. Feature-detect to avoid crashing
-// the npm bundle on older Node versions (e.g., CI runners with Node 20).
-// zstdCompress is available in Node 22.15+. Feature-detect to avoid crashing
-// the npm bundle on older Node versions (e.g., CI runners with Node 20).
-// biome-ignore lint/suspicious/noExplicitAny: zstd types unavailable on older @types/node
-const zstdCompressFn = (zlib as any).zstdCompress as
-  | ((...args: unknown[]) => unknown)
-  | undefined;
-const zstdCompressAsync =
-  typeof zstdCompressFn === "function"
-    ? (promisify(zstdCompressFn) as (
-        buf: Buffer,
-        opts?: unknown
-      ) => Promise<Buffer>)
-    : undefined;
+const gzipAsync = promisify(gzipCb);
+const zstdCompressAsync = promisify(zstdCompressCb);
 const log = logger.withTag("api.sourcemaps");
 
 // ── Schemas ─────────────────────────────────────────────────────────
@@ -219,13 +208,13 @@ export async function encodeChunk(
   buf: Buffer,
   encoding: UploadEncoding | undefined
 ): Promise<Uint8Array> {
-  if (encoding === "zstd" && zstdCompressAsync) {
+  if (encoding === "zstd") {
     // L3 is libzstd's default; passed explicitly for self-documenting
     // code. L9+ trades ~14% size for 4x compress time and forces the
     // server's decoder to allocate 15-30 MiB of window state -- not
     // worth it once decode cost is counted.
     return await zstdCompressAsync(buf, {
-      params: { [zlib.constants.ZSTD_c_compressionLevel]: 3 },
+      params: { [zlibConstants.ZSTD_c_compressionLevel]: 3 },
     });
   }
   if (encoding === "gzip") {

src/lib/api/sourcemaps.ts

@@ -139,7 +139,11 @@ export class Database {
         this.db.exec("COMMIT");
         return result;
       } catch (error) {
-        this.db.exec("ROLLBACK");
+        try {
+          this.db.exec("ROLLBACK");
+        } catch (rollbackError) {
+          log.debug("ROLLBACK failed after transaction error", rollbackError);
+        }
         throw error;
       }
     };

src/lib/db/sqlite.ts

@@ -21,7 +21,7 @@ import { unlinkSync } from "node:fs";
 
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
-import { compare as semverCompare } from "semver";
+import { compare as semverCompare, valid as semverValid } from "semver";
 
 import {
   GITHUB_RELEASES_URL,
@@ -460,10 +460,17 @@ export function filterAndSortChainTags(
   currentVersion: string,
   targetVersion: string
 ): string[] {
+  if (!(semverValid(currentVersion) && semverValid(targetVersion))) {
+    return [];
+  }
+
   const chainTags: { tag: string; version: string }[] = [];
 
   for (const tag of allTags) {
     const version = tag.slice(PATCH_TAG_PREFIX.length);
+    if (!semverValid(version)) {
+      continue;
+    }
     // Include tags where: currentVersion < version <= targetVersion
     if (
       semverCompare(version, currentVersion) === 1 &&

src/lib/delta-upgrade.ts

@@ -8,8 +8,11 @@
 import { existsSync } from "node:fs";
 import { access, readFile, writeFile } from "node:fs/promises";
 import { basename, delimiter, join } from "node:path";
+import { logger } from "./logger.js";
 import { whichSync } from "./which.js";
 
+const log = logger.withTag("shell");
+
 /** Supported shell types */
 export type ShellType = "bash" | "zsh" | "fish" | "sh" | "ash" | "unknown";
 
@@ -299,7 +302,12 @@ export async function addToGitHubPath(
     let content = "";
     try {
       content = await readFile(env.GITHUB_PATH, "utf-8");
-    } catch {
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== "ENOENT") {
+        log.debug(`Failed to read GITHUB_PATH (${code}):`, error);
+        return false;
+      }
       // File doesn't exist yet — start with empty content
     }
 
@@ -310,7 +318,8 @@ export async function addToGitHubPath(
       await writeFile(env.GITHUB_PATH, newContent, "utf-8");
     }
     return true;
-  } catch {
+  } catch (error) {
+    log.debug("Failed to update GITHUB_PATH:", error);
     return false;
   }
 }

src/lib/shell.ts

@@ -32,8 +32,11 @@ import * as http from "node:http";
 import * as https from "node:https";
 import { Readable } from "node:stream";
 import { promisify } from "node:util";
-// biome-ignore lint/performance/noNamespaceImport: needed for feature-detected zstd access
-import * as zlib from "node:zlib";
+import {
+  gzip as gzipCb,
+  constants as zlibConstants,
+  zstdCompress as zstdCompressCb,
+} from "node:zlib";
 import {
   createTransport,
   suppressTracing,
@@ -78,22 +81,8 @@ const ZSTD_THRESHOLD = 1024;
  */
 const GZIP_THRESHOLD = 1024 * 32;
 
-const gzipAsync = promisify(zlib.gzip);
-// zstdCompress is available in Node 22.15+. Feature-detect to avoid crashing
-// the npm bundle on older Node versions (e.g., CI runners with Node 20).
-// zstdCompress is available in Node 22.15+. Feature-detect to avoid crashing
-// the npm bundle on older Node versions (e.g., CI runners with Node 20).
-// biome-ignore lint/suspicious/noExplicitAny: zstd types unavailable on older @types/node
-const zstdCompressFn = (zlib as any).zstdCompress as
-  | ((...args: unknown[]) => unknown)
-  | undefined;
-const zstdCompressAsync =
-  typeof zstdCompressFn === "function"
-    ? (promisify(zstdCompressFn) as (
-        buf: Buffer,
-        opts?: unknown
-      ) => Promise<Buffer>)
-    : undefined;
+const gzipAsync = promisify(gzipCb);
+const zstdCompressAsync = promisify(zstdCompressCb);
 
 /**
  * Factory for the SDK's `Sentry.init({ transport })` option.
@@ -288,9 +277,9 @@ export async function maybeCompress(
     return { payload: buf, encodingApplied: "none" };
   }
 
-  if (encoding === "zstd" && zstdCompressAsync) {
+  if (encoding === "zstd") {
     const out = await zstdCompressAsync(buf, {
-      params: { [zlib.constants.ZSTD_c_compressionLevel]: ZSTD_LEVEL },
+      params: { [zlibConstants.ZSTD_c_compressionLevel]: ZSTD_LEVEL },
     });
     return {
       payload: Buffer.from(out.buffer, out.byteOffset, out.byteLength),
@@ -304,7 +293,7 @@ export async function maybeCompress(
 
 /** Feature-detect zstd support on the current runtime. */
 export function hasZstdSupport(): boolean {
-  return zstdCompressAsync !== undefined;
+  return typeof zstdCompressCb === "function";
 }
 
 /**