Findings No. 36
An undeclared transitive dependency is an outage waiting for someone else's release
SvelteKit's server tracing imports @opentelemetry/api dynamically. Present only through Sentry, its disappearance would make every traced request fail with no recovery.
If your code depends on a package that only arrives through someone else's dependency list, their next release can remove it from your app.
Replicator enables tracing: { server: true } in vite.config.ts. With that on, SvelteKit dynamically imports @opentelemetry/api, which we had never declared; it was present only because @sentry/node depends on it. Reading kit's source showed how badly a missing copy would fail. The import's failure path is .catch(() => e.tracing_api_missing()), which throws, and the result is memoized with ??=. A failed import would be cached as a rejection, so every traced request would return a 500 until the next deploy, with no recovery in between.
Nothing had broken yet. The fix was to declare @opentelemetry/api as a direct dependency, so a change to Sentry's dependency tree can no longer take tracing down. We then checked lj-website, which enables the same tracing option and had the same undeclared dependency, and declared it there too.
The general rule: if your configuration makes a framework import a package, declare that package yourself. Being installed today is not the same as being yours.
Receipt: Replicator v3.293.3 (vite.config.ts tracing.server; FINDINGS.md, "Vercel"); the same fix applied to lj-website on 2026-10-27.