`@sentry/tracing` does not work with modern `yarn` (in PnP mode)

[andreialecu]

Package + Version

• @sentry/node: 6.13.3
• @sentry/tracing: 6.13.3

Version:

6.13.3

Description

While trying to add tracing instrumentation for mongoose in a nodejs app that uses Yarn 3.0 in PnP mode I noticed that nothing was happening, and tracing was silently failing to do anything.

The problem is that PnP mode is strict about which dependencies are allowed to be required, and a package that doesn't define the dep in its package.json (dependencies or peerDependencies) will not be able to require it.

See: https://yarnpkg.com/advanced/rulebook/#packages-should-only-ever-require-what-they-formally-list-in-their-dependencies

Neither @sentry/tracing or @sentry/utils list mongoose/mongodb/pg/mysql as dependencies.

The reason this fails is:

sentry-javascript/packages/tracing/src/integrations/node/mongo.ts

Lines 122 to 123 in 84a6dc0

	const moduleName = this._useMongoose ? 'mongoose' : 'mongodb';
	const pkg = loadModule<{ Collection: MongoCollection }>(moduleName);

Which then delegates to:

sentry-javascript/packages/utils/src/node.ts

Lines 42 to 46 in 84a6dc0

	try {
	mod = dynamicRequire(module, moduleName);
	} catch (e) {
	// no-empty
	}

That empty catch actually suppresses this error:

Error: @sentry/utils tried to access mongoose (a peer dependency) but it isn't provided by its ancestors; this makes the require call ambiguous and unsound.

Required package: mongoose
Required by: @sentry/utils@virtual:...

Ancestor breaking the chain: @sentry/core@npm:6.13.3
Ancestor breaking the chain: @sentry/hub@npm:6.13.3
Ancestor breaking the chain: @sentry/node@npm:6.13.3

This is going to be tricky to fix because of the long chain of dependencies needing to pass the target dependency along properly.

One possible suggestion to get around this would be to:

• make the error clearer to the user
• make it possible to inject the library via the constructor in:
  

  sentry-javascript/packages/tracing/src/integrations/node/mongo.ts

  Lines 85 to 89 in 84a6dc0

  	interface MongoOptions {
  	operations?: Operation[];
  	describeOperations?: boolean | Operation[];
  	useMongoose?: boolean;
  	}

The caller might then do something like:

const MongoTracingIntegration = new Tracing.Integrations.Mongo({
  collection: require("mongoose").Collection,
});

This would bypass the require call being done by the sentry library, and delegate it to the user instead, providing a way around the problem.

Something similar would need to be done with all the other integrations.

Slightly related: #3172 (different issue on PnP)

[andreialecu]

Found a simpler solution that doesn't require any changes to the API and fixed this in #4077

[github-actions]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Backlog or Status: In Progress, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀