server-runtime-injection: build/esm/package.json is not traced, so hook.js fails to load as ESM on Vercel (Node 22) #25480

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/nextjs

SDK Version

11.8.0 (latest): build/trace issue confirmed locally. Runtime warning reproduced on Vercel with 11.6.0; register.ts is identical between 11.6.0 and 11.8.0.

Framework Version

Next.js 16.3.8 on Vercel Functions nodejs22.x (webpack build, default next build)

Link to Sentry event

No response

Reproduction Example/SDK Setup

Related to #23831 (closed). After #23687, build/esm/hook.js is traced, but the sibling build/esm/package.json ({"type":"module"}) is not.

// instrumentation.ts
import * as Sentry from '@sentry/nextjs'

export async function register() {
  if (process.env.NEXT_RUNTIME === 'nodejs') {
    Sentry.init({ dsn: process.env.NEXT_PUBLIC_SENTRY_DSN, tracesSampleRate: 0.1 })
  }
}

export const onRequestError = Sentry.captureRequestError

Steps to Reproduce

1. Deploy a Next.js 16 app using @sentry/nextjs (11.6.0–11.8.0) to Vercel on the nodejs22.x runtime.
2. Trigger a cold start of any Node.js function (e.g. GET /api/health).
3. Check the runtime logs.

Expected Result

The diagnostics-channel injection hook registers successfully (or is skipped silently when nothing needs it). No warnings.

Actual Result

Every cold start logs this pair:

[Sentry] Failed to register diagnostics-channel injection hooks, so channel-based integrations will not record spans. See https://docs.sentry.io/platforms/javascript/guides/node/troubleshooting/
(node:7) Warning: Failed to load the ES module: /var/task/node_modules/@sentry/server-runtime-injection/build/esm/hook.js. Make sure to set "type": "module" in the nearest package.json file or use the .mjs extension.

Additional Context

Cause

• On Node < 24.13, registerDiagnosticsChannelInjection() uses Module.register(join(__dirname, '../esm/hook.js')).
• Since fix(server-runtime-injection): Resolve the orchestrion ESM hook by path so build tracers follow it #23687, @vercel/nft follows that literal path, so build/esm/hook.js is traced.
• What marks build/esm as ESM is build/esm/package.json ({"type":"module"}). Nothing references it, so it is not traced. The package root package.json has no type field.
• In the deployed bundle, the nearest package.json for hook.js is therefore the root one, so Node 22 treats hook.js as CommonJS and fails on its export statements.

Evidence

• Local next build, scanning all 127 .nft.json files: build/esm/hook.js appears in 75, build/esm/package.json in 0, the package root package.json in 75. Identical result on 11.6.0 and 11.8.0.
• Same build on Vercel nodejs22.x: a cold start with injection enabled produced the warning pair above. With enableRuntimeChannelInjection: false, it produced none. A positive-control log line from the same deployment confirmed that logs were being collected.
• Not reproducible locally on Node 24.20: that version uses Module.registerHooks(), and even when forced through Module.register(), syntax detection loads the untyped .js file as ESM. This is why it slips past local testing.

Impact
Users who depend on any of the instrumented libraries (pg, prisma, redis, …) silently lose those spans on Vercel Node 22. Error capture is not affected.

Possible fixes

• (a) Reference build/esm/package.json in a way nft follows (e.g. a require.resolve/readFileSync of it next to the hook path).
• (b) Ship the hook as hook.mjs, so its format no longer depends on a package.json.

Workaround
outputFileTracingIncludes for node_modules/@sentry/server-runtime-injection/build/esm/package.json, or enableRuntimeChannelInjection: false if no instrumented libraries are used.

Priority

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it.}