feat(bun): Add orchestrion bun build plugin

[isaacs]

Use the orchestrion plugin defined in server-utils, and create a plugin that Bun can use in bun build mode.

Note: this does not provide a plugin for use with bun run, because that feature is blocked by oven-sh/bun#31770

When that issue resolves, we can look into providing this for the bun runtime, likely with a version guard to avoid the footgun of removing CommonJS exports in some cases.

[github-actions]

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	27.45 kB	-	-
@sentry/browser - with treeshaking flags	25.88 kB	-	-
@sentry/browser (incl. Tracing)	45.89 kB	-	-
@sentry/browser (incl. Tracing + Span Streaming)	48.12 kB	-0.02%	-5 B 🔽
@sentry/browser (incl. Tracing, Profiling)	50.67 kB	-	-
@sentry/browser (incl. Tracing, Replay)	85.08 kB	-	-
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	74.69 kB	-	-
@sentry/browser (incl. Tracing, Replay with Canvas)	89.78 kB	-	-
@sentry/browser (incl. Tracing, Replay, Feedback)	102.45 kB	-	-
@sentry/browser (incl. Feedback)	44.62 kB	-	-
@sentry/browser (incl. sendFeedback)	32.25 kB	-	-
@sentry/browser (incl. FeedbackAsync)	37.38 kB	-	-
@sentry/browser (incl. Metrics)	28.52 kB	-	-
@sentry/browser (incl. Logs)	28.76 kB	-	-
@sentry/browser (incl. Metrics & Logs)	29.45 kB	-	-
@sentry/react	29.25 kB	-	-
@sentry/react (incl. Tracing)	48.18 kB	-	-
@sentry/vue	32.56 kB	-	-
@sentry/vue (incl. Tracing)	47.76 kB	-	-
@sentry/svelte	27.48 kB	-	-
CDN Bundle	29.86 kB	-	-
CDN Bundle (incl. Tracing)	48.29 kB	-0.02%	-5 B 🔽
CDN Bundle (incl. Logs, Metrics)	31.4 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics)	49.59 kB	-0.01%	-3 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics)	70.71 kB	-	-
CDN Bundle (incl. Tracing, Replay)	85.62 kB	-0.01%	-4 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.88 kB	-0.01%	-3 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback)	91.46 kB	-0.01%	-3 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	92.71 kB	-0.01%	-1 B 🔽
CDN Bundle - uncompressed	88.8 kB	-	-
CDN Bundle (incl. Tracing) - uncompressed	146.08 kB	-0.01%	-4 B 🔽
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.5 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	150.06 kB	-0.01%	-4 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	218.33 kB	-	-
CDN Bundle (incl. Tracing, Replay) - uncompressed	264.95 kB	-0.01%	-4 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	268.91 kB	-0.01%	-4 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	278.65 kB	-0.01%	-4 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	282.6 kB	-0.01%	-4 B 🔽
@sentry/nextjs (client)	50.58 kB	-	-
@sentry/sveltekit (client)	46.27 kB	-	-
@sentry/core/server	76.16 kB	-0.01%	-2 B 🔽
@sentry/core/browser	63.31 kB	-0.01%	-2 B 🔽
@sentry/node-core	61.87 kB	-0.01%	-2 B 🔽
@sentry/node	126.78 kB	+1.71%	+2.13 kB 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)	70.05 kB	-	-
@sentry/node/light	50.92 kB	-0.01%	-2 B 🔽
@sentry/node - without tracing	74.23 kB	-0.01%	-2 B 🔽
@sentry/aws-serverless	85.34 kB	-0.01%	-3 B 🔽
@sentry/cloudflare (withSentry) - minified	174.48 kB	-0.01%	-4 B 🔽
@sentry/cloudflare (withSentry)	436.52 kB	-0.01%	-23 B 🔽

View base workflow run

[github-actions]

👋 @mydea, @JPeer264 — Please review this PR when you get a chance!

[semgrep-code-getsentry]

Semgrep found 1 ssc-d17d3487-883b-46a9-bec9-dee3375f7532 finding:

• yarn.lock
  • L15987 - Triage

Risk: Affected versions of esbuild are vulnerable to Download of Code Without Integrity Check / Untrusted Search Path. esbuild's Deno distribution module (lib/deno/mod.ts) contains an import.meta.main CLI entrypoint that calls install() directly when the module is run as a script (deno run https://deno.land/x/esbuild@vX/mod.js). This download path has no SHA-256 integrity verification: if NPM_CONFIG_REGISTRY resolves to an attacker-controlled registry, the fetched binary is executed immediately, yielding arbitrary code execution without any API call in user code.

Manual Review Advice: A vulnerability from this advisory is reachable if you invoke the esbuild Deno module directly as a CLI tool (e.g. deno run https://deno.land/x/esbuild@vX/mod.js) and the NPM_CONFIG_REGISTRY environment variable resolves the binary download to an untrusted registry

Fix: Upgrade this library to at least version 0.28.1 at sentry-javascript/yarn.lock:15987.

Reference(s): GHSA-gv7w-rqvm-qjhr

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 54e9bb3. Configure here.}