Distillation

<observations> Date: June 23, 2026

🟡 (09:52) package.json overrides changed: vite 7 override updated from "vite@>=7.0.0 <7.3.2": ">=7.3.2" → "vite@>=7.0.0 <7.3.5": ">=7.3.5 <8" (bounded to <8 to prevent vite 8.x major jump); tar override >=7.5.11 → >=7.5.16; form-data override >=4.0.4 → >=4.0.6; new override added: "@opentelemetry/core": ">=2.8.0"
🟡 (09:52) packages/website/package.json: astro direct dep bumped ^6.1.10 → ^6.4.6 (resolves 6.4.8)
🟡 (09:52) Commit 4fe8ff1a7a8473c833802e09f57d2cdaf723f8d4 on branch security/deps-resolve-open-alerts: "security(deps): resolve 7 open dependabot alerts" — 4 files changed, 174 insertions(+), 108 deletions(-); biome pre-commit hook passed; author byk@sentry.io
🟡 (09:52) Commit message references: tar GHSA-vmf3-w455-68vh #287, form-data GHSA-hmw2-7cc7-3qxx #286, vite GHSA-fx2h-pf6j-xcff #282 + GHSA-v6wh-96g9-6wx3 #285, @opentelemetry/core GHSA-8988-4f7v-96qf #281, astro GHSA-2pvr-wf23-7pc7 #283 + GHSA-jrpj-wcv7-9fh9 #284
🟡 (09:52) Decision: vite 7 override bounded to <8 — unbounded >=7.3.5 would pull vite 8.x (major jump); cap honors astro's vite@^7.3.2 peer dep and keeps change minimal
🟡 (09:53) Branch security/deps-resolve-open-alerts pushed to origin; PR #1326 created at https://github.com/getsentry/spotlight/pull/1326
🟡 (09:54) PR #1326 auto-merge (squash) enabled; mergeStateStatus: BLOCKED at time of enabling
🟡 (10:04) CI first run results for PR #1326: 1 failed (E2E UI Tests, 3m46s), 45 passed; all other checks passed including Build (2m46s), Unit Tests 20/22/24, E2E CLI Tests 20/22/24, CodeQL, semgrep, warden, dependency-review, Vercel deployment
🟡 (10:04) E2E UI Tests failure: packages/spotlight/tests/e2e/ui/attachments.e2e.test.ts:64 — test "should display attachments from fixture directory"; assertion expect(text).not.toBe("") failed with text=""; 30s timeout exceeded; failed all 3 retries (retry #1 and #2 same error); 45 passed, 1 failed
🟡 (10:05) Flake investigation: failing test (line 56-65) is most trivial in file — loads sidecar.baseURL, waits for body, asserts text not empty, no envelope sent; 45 other tests including structurally identical ones passed; each test spins own sidecar with health check — if runtime deps (otel core 2.8.0, tar, form-data) broke server, all 46 would fail; test file last changed in commits 3bc6908d (profiling) and e50d2522 (e2e infra setup)
🟡 (10:05) E2E fixture architecture: each test creates own sidecar via startSidecar() (dist/run.js, random free port, 10s health check timeout); sendTestEnvelope POSTs to /stream with Content-Type application/x-sentry-envelope + 500ms settle delay; sidecar torn down after each test
🟡 (10:06) Rerun triggered for failed E2E UI Tests job (run 28017786247, job 82928666808)
🟡 (10:10) E2E UI Tests re-run passed (

Distillation

Observations