Merge pull request #25628 from getsentry/prepare-release/11.9.0

meta(changelog): Update changelog for 11.9.0

Author: s1gr1d

.agents/skills/add-cdn-bundle/SKILL.md

@@ -50,7 +50,7 @@ Given a feature combination, derive these variants:
 After making changes:
 
 ```bash
-yarn lint
-cd packages/browser && yarn build:dev
-cd packages/browser && yarn test
+pnpm run lint
+cd packages/browser && pnpm run build:dev
+cd packages/browser && pnpm run test
 ```

.agents/skills/backport-pr/SKILL.md

@@ -113,28 +113,28 @@ git cherry-pick <mergeCommit-oid>
 ### 4. Build and verify
 
 Run the repo's pre-commit checks. Do this **before** finalizing the commit in step 5, because
-`yarn format` writes changes to the working tree — those fixes must end up inside the backport
+`pnpm run format` writes changes to the working tree — those fixes must end up inside the backport
 commit, not left dangling after it (otherwise you'd push an unformatted tree and CI would fail
 on a commit that doesn't match your local state).
 
 ```bash
-yarn format
-yarn lint:fix
-yarn build:dev
+pnpm run format
+pnpm run lint:fix
+pnpm run build:dev
 ```
 
-Use `lint:fix`, not `lint` — plain `yarn lint` only reports, so auto-fixable issues would
+Use `lint:fix`, not `lint` — plain `pnpm run lint` only reports, so auto-fixable issues would
 otherwise survive to fail CI.
 
-Run tests scoped to the touched packages when possible (full `yarn test` if unsure). If the
+Run tests scoped to the touched packages when possible (full `pnpm run test` if unsure). If the
 target major's toolchain differs and a check fails for reasons unrelated to the change, note
 it for the user rather than silently skipping.
 
 ### 5. Finalize the commit (fold in verification changes)
 
 First stage the format/lint fixes. Use `git add -u` so only tracked files the cherry-pick and
 verification touched are staged, not unrelated local edits — sanity-check with `git status`
-first if `yarn format` may have reformatted files outside the backport.
+first if `pnpm run format` may have reformatted files outside the backport.
 
 ```bash
 git add -u
@@ -172,7 +172,7 @@ git status --porcelain   # expect no output
 
 ### 6. Diff the backport against the original PR
 
-Even a cherry-pick that reported no conflicts can end up different — `yarn format`/`lint:fix`
+Even a cherry-pick that reported no conflicts can end up different — `pnpm run format`/`lint:fix`
 on the older toolchain, dropped hunks, adaptations you made in step 3. Compare the final commit
 against the original before writing the PR body, rather than trusting your memory of step 3:
 

.agents/skills/bump-conventions/SKILL.md

@@ -6,7 +6,7 @@ argument-hint: '[version]  # e.g. 0.16.0; defaults to latest on npm'
 
 # Bump `@sentry/conventions`
 
-Bump `@sentry/conventions` across every `package.json` at once, keeping the two pin styles consistent, then refresh `yarn.lock`.
+Bump `@sentry/conventions` across every `package.json` at once, keeping the two pin styles consistent, then refresh `pnpm-lock.yaml`.
 
 ## 1. Determine the target version
 
@@ -28,31 +28,31 @@ Edit only the version string; leave the caret alone. If a file declares a versio
 ## 3. Refresh the lockfile and build
 
 ```bash
-yarn install
-yarn dedupe-deps:fix
-yarn build:dev
+pnpm install
+pnpm run dedupe-deps:fix
+pnpm run build:dev
 ```
 
-`yarn install` collapses the combined `yarn.lock` entry (`"@sentry/conventions@<OLD>", "@sentry/conventions@^<OLD>":`) onto the new version. Confirm no stale `<OLD>` resolution remains:
+`pnpm install` resolves both pin styles to the new version in `pnpm-lock.yaml`. Confirm no stale `<OLD>` resolution remains:
 
 ```bash
-grep -n '@sentry/conventions@' yarn.lock
+grep -n '@sentry/conventions@' pnpm-lock.yaml
 ```
 
 ## 4. Check for breaking API changes
 
-A `conventions` bump can rename or remove exported attribute constants. If `yarn build:dev` fails, inspect the type errors and update usages in `src/` **and** `test/`. Heaviest consumers: `packages/core`, `packages/opentelemetry`, `packages/aws-serverless`.
+A `conventions` bump can rename or remove exported attribute constants. If `pnpm run build:dev` fails, inspect the type errors and update usages in `src/` **and** `test/`. Heaviest consumers: `packages/core`, `packages/opentelemetry`, `packages/aws-serverless`.
 
 Use LSP `findReferences` on the changed export to catch every call site. Do not paper over a rename with a cast.
 
-After fixing, re-run `yarn build:dev` and confirm it passes before verifying, so the next step runs against fresh build output.
+After fixing, re-run `pnpm run build:dev` and confirm it passes before verifying, so the next step runs against fresh build output.
 
 ## 5. Final verification
 
 ```bash
-yarn circularDepCheck
-yarn fix
-yarn test
+pnpm run circularDepCheck
+pnpm run fix
+pnpm run test
 ```
 
 ## Commit

.agents/skills/bump-size-limit/SKILL.md

@@ -14,15 +14,15 @@ When the size-limit GitHub Action fails, it means one or more bundle scenarios e
 A full build is required because size-limit measures the actual compiled artifacts.
 
 ```bash
-yarn build
+pnpm run build
 ```
 
 This takes a few minutes. CDN bundles in `packages/browser/build/bundles/` must be up to date — a dev build is not sufficient.
 
 ### Step 2: Run the size check in JSON mode
 
 ```bash
-yarn test:size-limit
+pnpm run test:size-limit
 ```
 
 The JSON output is an array of objects. Each object has:
@@ -55,7 +55,7 @@ Only change limits for scenarios that actually failed. Do not touch passing scen
 Re-run size-limit to confirm everything passes:
 
 ```bash
-yarn test:size-limit
+pnpm run test:size-limit
 ```
 
 If any scenario still fails (e.g., due to rounding edge cases), bump that specific limit by another 1 KB and re-run.

.agents/skills/dotagents/references/config-schema.md

@@ -3,15 +3,15 @@
 ## Top-Level Structure
 
 ```toml
-version = 1                     # Required, must be 1
-gitignore = true                # Optional, default true
-agents = ["claude", "cursor"]   # Optional, agent targets
-
-[project]                       # Optional
-[trust]                         # Optional
-[[skills]]                      # Optional, array of skill entries
-[[mcp]]                         # Optional, array of MCP servers
-[[hooks]]                       # Optional, array of hook declarations
+version = 1 # Required, must be 1
+gitignore = true # Optional, default true
+agents = ["claude", "cursor"] # Optional, agent targets
+
+[project] # Optional
+[trust] # Optional
+[[skills]] # Optional, array of skill entries
+[[mcp]] # Optional, array of MCP servers
+[[hooks]] # Optional, array of hook declarations
 ```
 
 ## Top-Level Fields
@@ -26,14 +26,14 @@ agents = ["claude", "cursor"]   # Optional, agent targets
 
 ```toml
 [project]
-name = "my-project"             # Optional, display name
+name = "my-project" # Optional, display name
 ```
 
 ## Symlinks Section
 
 ```toml
 [symlinks]
-targets = [".claude", ".cursor"]  # Legacy: explicit symlink targets
+targets = [".claude", ".cursor"] # Legacy: explicit symlink targets
 ```
 
 When `agents` is set, symlink targets are derived automatically. The `[symlinks]` section is for backward compatibility.
@@ -44,10 +44,10 @@ When `agents` is set, symlink targets are derived automatically. The `[symlinks]
 
 ```toml
 [[skills]]
-name = "find-bugs"              # Required, unique skill identifier
-source = "getsentry/skills"     # Required, skill source
-ref = "v1.0.0"                  # Optional, pin to tag/branch/commit
-path = "tools/my-skill"         # Optional, subdirectory within repo
+name = "find-bugs" # Required, unique skill identifier
+source = "getsentry/skills" # Required, skill source
+ref = "v1.0.0" # Optional, pin to tag/branch/commit
+path = "tools/my-skill" # Optional, subdirectory within repo
 ```
 
 | Field    | Type   | Required | Description                                                   |
@@ -61,10 +61,10 @@ path = "tools/my-skill"         # Optional, subdirectory within repo
 
 ```toml
 [[skills]]
-name = "*"                      # Wildcard: install all skills from source
-source = "getsentry/skills"     # Required
-ref = "v1.0.0"                  # Optional
-exclude = ["deprecated-skill"]  # Optional, skills to skip
+name = "*" # Wildcard: install all skills from source
+source = "getsentry/skills" # Required
+ref = "v1.0.0" # Optional
+exclude = ["deprecated-skill"] # Optional, skills to skip
 ```
 
 | Field     | Type          | Required | Description                        |
@@ -78,13 +78,13 @@ exclude = ["deprecated-skill"]  # Optional, skills to skip
 
 ```toml
 [trust]
-allow_all = true                    # Allow any source
+allow_all = true # Allow any source
 
 # OR restrict to specific sources:
 [trust]
-github_orgs = ["getsentry"]         # GitHub org names
-github_repos = ["ext-org/repo"]     # Exact owner/repo pairs
-git_domains = ["git.corp.example.com"]  # Git URL domains
+github_orgs = ["getsentry"] # GitHub org names
+github_repos = ["ext-org/repo"] # Exact owner/repo pairs
+git_domains = ["git.corp.example.com"] # Git URL domains
 ```
 
 | Field          | Type     | Description                                |
@@ -102,17 +102,17 @@ No `[trust]` section = allow all sources (backward compatible).
 
 ```toml
 [[mcp]]
-name = "github"                     # Required, unique server name
-command = "npx"                     # Required for stdio
-args = ["-y", "@modelcontextprotocol/server-github"]  # Optional
-env = ["GITHUB_TOKEN"]             # Optional, env vars to pass through
+name = "github" # Required, unique server name
+command = "npx" # Required for stdio
+args = ["-y", "@modelcontextprotocol/server-github"] # Optional
+env = ["GITHUB_TOKEN"] # Optional, env vars to pass through
 ```
 
 ### HTTP Transport
 
 ```toml
 [[mcp]]
-name = "remote-api"                 # Required, unique server name
+name = "remote-api" # Required, unique server name
 url = "https://mcp.example.com/sse" # Required for HTTP
 ```
 
@@ -129,9 +129,9 @@ url = "https://mcp.example.com/sse" # Required for HTTP
 
 ```toml
 [[hooks]]
-event = "PreToolUse"                # Required
-matcher = "Bash"                    # Optional, tool name filter
-command = "my-lint-check"           # Required
+event = "PreToolUse" # Required
+matcher = "Bash" # Optional, tool name filter
+command = "my-lint-check" # Required
 ```
 
 | Field     | Type   | Required | Description                                             |

.agents/skills/e2e/SKILL.md

@@ -39,7 +39,7 @@ For each modified package, rebuild its tarball:
 
 ```bash
 cd packages/<package-name>
-yarn build && yarn build:tarball
+pnpm run build && pnpm run build:tarball
 cd ../..
 ```
 
@@ -49,7 +49,7 @@ If the user says "I changed @sentry/node" or similar, rebuild just that package:
 
 ```bash
 cd packages/node
-yarn build && yarn build:tarball
+pnpm run build && pnpm run build:tarball
 cd ../..
 ```
 
@@ -75,14 +75,14 @@ Navigate to the e2e-tests directory and run the test:
 
 ```bash
 cd dev-packages/e2e-tests
-yarn test:run <app-name>
+pnpm run test:run <app-name>
 ```
 
 If a variant was specified:
 
 ```bash
 cd dev-packages/e2e-tests
-yarn test:run <app-name> --variant <variant-name>
+pnpm run test:run <app-name> --variant <variant-name>
 ```
 
 ### Step 5: Report Results
@@ -114,11 +114,11 @@ All tests completed successfully. Your SDK changes work correctly with this test
 
 ## Error Handling
 
-- **No tarballs found**: Run `yarn build && yarn build:tarball` at repository root
+- **No tarballs found**: Run `pnpm run build && pnpm run build:tarball` at repository root
 - **Test app not found**: List available apps and ask user to clarify
-- **Packed tarballs missing**: Run `yarn build:tarball` at the repo root, then `yarn test:prepare` in `dev-packages/e2e-tests`
+- **Packed tarballs missing**: Run `pnpm run build:tarball` at the repo root, then `pnpm run test:prepare` in `dev-packages/e2e-tests`
 - **Build failures**: Fix build errors before running tests
-- **pnpm errors such as `packages field missing or empty`**: The app needs the pnpm version in its `volta.pnpm`. Run with Volta, which installs that version
+- **`ERR_PNPM_IGNORED_BUILDS`**: A dependency has a build script that the app's `allowBuilds` does not list. Add it to the app's `pnpm-workspace.yaml`: `true` if the app needs the script, `false` if the script only prints a message. `pnpm approve-builds <pkg>` (or `!<pkg>` for `false`) in the app's temp copy writes the entry there, so copy it back to the app
 
 ## Common Test Applications
 
@@ -148,12 +148,12 @@ ls dev-packages/e2e-tests/test-applications/
 # Step 1: Detect recent changes to packages/node
 # Step 2: Rebuild the modified package
 cd packages/node
-yarn build && yarn build:tarball
+pnpm run build && pnpm run build:tarball
 cd ../..
 
 # Step 3: Run the test
 cd dev-packages/e2e-tests
-yarn test:run node-express-esm-loader
+pnpm run test:run node-express-esm-loader
 ```
 
 ### Example 2: First-time test run
@@ -163,11 +163,11 @@ yarn test:run node-express-esm-loader
 
 # Step 1: Check for existing tarballs
 # Step 2: None found, build all packages
-yarn build && yarn build:tarball
+pnpm run build && pnpm run build:tarball
 
 # Step 3: Run the test
 cd dev-packages/e2e-tests
-yarn test:run nextjs-app-dir
+pnpm run test:run nextjs-app-dir
 ```
 
 ### Example 3: With variant
@@ -178,7 +178,7 @@ yarn test:run nextjs-app-dir
 # Step 1: Rebuild if needed
 # Step 2: Run with variant
 cd dev-packages/e2e-tests
-yarn test:run nextjs-app-dir --variant nextjs-15
+pnpm run test:run nextjs-app-dir --variant nextjs-15
 ```
 
 ## Tips

.agents/skills/fix-issue/SKILL.md

@@ -73,7 +73,7 @@ A single `-m` only sets the subject — the footer would be silently dropped, an
 
 **Commit message format:** Conventional Commits — `<type>` is one of `test`, `fix`, `feat`, `ref`, `chore`, `docs`, `ci`. Look at recent commits (`git log --oneline -10`) for examples. The PR body in Step 7 will also include `Fixes #<issue-number>` as a belt-and-suspenders — GitHub recognizes the closing keyword in either place.
 
-**Do NOT run `yarn format` / `yarn lint` / `yarn test` / `yarn build:dev` before committing.** `CLAUDE.md` / `AGENTS.md` list a "Before Every Commit" checklist that includes those, but this workflow does not allowlist `yarn` (per Step 5 / Turn economy). CI will run lint and tests on the opened PR; rely on that. The pre-commit checklist in those docs does not apply to this skill.
+**Do NOT run `pnpm run format` / `pnpm run lint` / `pnpm run test` / `pnpm run build:dev` before committing.** `CLAUDE.md` / `AGENTS.md` list a "Before Every Commit" checklist that includes those, but this workflow does not allowlist `pnpm` (per Step 5 / Turn economy). CI will run lint and tests on the opened PR; rely on that. The pre-commit checklist in those docs does not apply to this skill.
 
 ### Step 7: Open a PR
 
@@ -116,7 +116,7 @@ Your budget is measured in _agent turns_ (assistant messages), not individual to
 - Plan before acting. Prefer targeted commands over broad ones: read specific line ranges instead of whole files; grep for the exact symbol instead of listing directories.
 - In each turn, issue all independent tool calls in parallel rather than spreading them across multiple turns.
 - Do NOT re-read a file you just edited to "verify" — the edit either succeeded or errored.
-- Do NOT run tests, linters, formatters, or builds. This workflow does not allowlist `yarn`/`npm`/`npx`; verification is static-only per Step 5. Attempting a test command will be blocked and waste a turn.
+- Do NOT run tests, linters, formatters, or builds. This workflow does not allowlist `pnpm`/`npm`/`npx`; verification is static-only per Step 5. Attempting a test command will be blocked and waste a turn.
 - If a search returned what you need, stop searching. Do not look for confirmation.
 
 ## Turn budget