Default Hono integration can terminate bundled Bun apps without Hono on read-only filesystems #25540

Summary

Calling Sentry.init() with the default integrations in a bundled Bun application that does not use or install Hono can terminate the process on a restricted filesystem. The default Hono integration eagerly tries to require hono/bun. Bun enters its runtime package-cache initialization path, fails to create the cache, and exits natively before the missing-module error can be caught.

This caused a production Vercel Bun function to fail at startup, including its health endpoint. No application framework or server is needed for the reproduction below.

Environment

• Sentry SaaS
• @sentry/bun@11.8.0 (latest npm release when checked)
• Also reproduced with @sentry/node@11.8.0 running under Bun
• Local reproduction: Bun 1.3.11, macOS 27.0, arm64
• Original production failure: Vercel Bun runtime (bunVersion: "1.x"); exact production Bun patch version not captured
• Bundler: bun build --target=bun --format=esm
• Hono is not installed or used

Minimal SDK setup

Save as build/repro.ts:

import * as Sentry from "@sentry/bun";

Sentry.init({
  dsn: "https://public@example.invalid/1",
  tracesSampleRate: 0,
  integrations: (defaults) => process.env.WITHOUT_HONO === "1"
    ? defaults.filter((integration) => integration.name !== "Hono")
    : defaults,
});
console.log("Sentry initialized");
process.exit(0);

The integrations callback returns the defaults unchanged unless WITHOUT_HONO=1; it exists only to demonstrate the one-variable control. The DSN is deliberately fake and no event is sent.

Steps to reproduce on macOS

Use a new temporary directory outside an existing project. Build and runtime directories must be siblings so the runtime has no ancestor node_modules directory.

repro_root=$(mktemp -d /tmp/sentry-hono-repro.XXXXXX)
mkdir "$repro_root/build" "$repro_root/runtime"
# Save the TypeScript above as "$repro_root/build/repro.ts".
cat > "$repro_root/build/package.json" <<'JSON'
{"private":true,"type":"module","dependencies":{"@sentry/bun":"11.8.0"}}
JSON
bun install --cwd "$repro_root/build"
bun build "$repro_root/build/repro.ts" --target=bun --format=esm \
  --outfile "$repro_root/runtime/repro.mjs"
cd "$repro_root/runtime"
export BUN_INSTALL_CACHE_DIR="$repro_root/blocked-cache"
unset WITHOUT_HONO

# Default integrations: exits 1 before printing "Sentry initialized".
sandbox-exec -p '(version 1)(allow default)(deny file-write*)' bun repro.mjs

# Same bundle and filesystem restrictions, only Hono removed: exits 0.
WITHOUT_HONO=1 sandbox-exec -p '(version 1)(allow default)(deny file-write*)' \
  bun repro.mjs

# Default integrations, only Bun auto-install disabled: also exits 0.
sandbox-exec -p '(version 1)(allow default)(deny file-write*)' \
  bun --no-install repro.mjs

Expected result

An application that does not use Hono should initialize successfully without trying to load/install Hono. An unavailable optional framework integration should be skipped without requiring filesystem writes.

Actual result

Default integrations, sandboxed macOS reproduction:

error: bun is unable to write files: PermissionDenied

Process exit status: 1.

Production Vercel log:

error: bun is unable to write files: ReadOnlyFileSystem
Bun process exited with exit status: 1.

Both controls print Sentry initialized and exit 0. macOS sandbox denial and Vercel's read-only mount yield different OS errors; the same Bun package-cache failure path is involved.

Isolation and source pointers

Using the exact original initialization options, both @sentry/bun@11.8.0 and @sentry/node@11.8.0 failed 3/3 runs under these restrictions. Filtering out only the integration named Hono made each SDK start 3/3 times. The standalone minimal example above was also tested with both controls.

• Both SDKs include the Hono error integration in their defaults, even with tracing disabled.
• Bun/Deno eagerly invoke the integration callback.
• instrumentHono() eagerly calls resolveGetConnInfo(), which requires hono/bun on Bun.
• Bun's package-cache initialization falls back to creating node_modules/.cache and calls Global.crash() on failure.

The native process exit means the SDK's existing try/catch around the optional require cannot recover. Bun's fatal cache behavior is a related runtime issue; this report concerns the default Sentry integration triggering it in an application with no Hono dependency.

Searching existing issues for hono/bun and Hono/cache did not reveal a matching report. The production app currently avoids this by removing server instrumentation; filtering Hono is a locally verified workaround, not a claim of full Vercel validation.