From 9653981cc963b25beda38f5504d9d88f0a8fb0fe Mon Sep 17 00:00:00 2001
From: Andrei Borza <andrei.borza@sentry.io>
Date: Fri, 4 Sep 2026 17:02:57 +0200
Subject: [PATCH 1/2] ref(bundler-plugins): Replace `find-up` with a local
 package.json lookup

---
 packages/bundler-plugins/package.json      |  1 -
 packages/bundler-plugins/src/core/utils.ts | 37 +++++++++++++++-------
 2 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/packages/bundler-plugins/package.json b/packages/bundler-plugins/package.json
index 1b632dd79cf9..040ddcff9974 100644
--- a/packages/bundler-plugins/package.json
+++ b/packages/bundler-plugins/package.json
@@ -113,7 +113,6 @@
     "@babel/core": "^7.18.5",
     "@sentry/core": "10.67.0",
     "dotenv": "^17.4.2",
-    "find-up": "^5.0.0",
     "glob": "^13.0.6",
     "magic-string": "~0.30.8",
     "sentry": "^0.44.0",
diff --git a/packages/bundler-plugins/src/core/utils.ts b/packages/bundler-plugins/src/core/utils.ts
index 742e0e5361d7..f0d8952dc131 100644
--- a/packages/bundler-plugins/src/core/utils.ts
+++ b/packages/bundler-plugins/src/core/utils.ts
@@ -1,5 +1,4 @@
 /* oxlint-disable max-lines */
-import findUp from 'find-up';
 import path from 'path';
 import fs from 'fs';
 import os from 'os';
@@ -138,18 +137,32 @@ export function getDependencies(packageJson: PackageJson): {
   return { deps, depsVersions };
 }
 
-function lookupPackageJson(cwd: string, stopAt: string): PackageJson | undefined {
-  const jsonPath = findUp.sync(
-    dirName => {
-      // Stop if we reach this dir
-      if (path.normalize(dirName) === stopAt) {
-        return findUp.stop;
-      }
+function findPackageJson(cwd: string, stopAt: string): string | undefined {
+  let dirName = path.resolve(cwd);
 
-      return findUp.sync.exists(`${dirName}/package.json`) ? 'package.json' : undefined;
-    },
-    { cwd },
-  );
+  for (;;) {
+    // Stop if we reach this dir
+    if (path.normalize(dirName) === stopAt) {
+      return undefined;
+    }
+
+    const jsonPath = path.join(dirName, 'package.json');
+    if (fs.existsSync(jsonPath)) {
+      return jsonPath;
+    }
+
+    const parentDirName = path.dirname(dirName);
+    // We reached the file system root
+    if (parentDirName === dirName) {
+      return undefined;
+    }
+
+    dirName = parentDirName;
+  }
+}
+
+function lookupPackageJson(cwd: string, stopAt: string): PackageJson | undefined {
+  const jsonPath = findPackageJson(cwd, stopAt);
 
   if (!jsonPath) {
     return undefined;

From c59486afe08db2ed1c3d20b04837b031eea0f1d1 Mon Sep 17 00:00:00 2001
From: Andrei Borza <andrei.borza@sentry.io>
Date: Fri, 4 Sep 2026 17:06:23 +0200
Subject: [PATCH 2/2] Cover the file system root guard in the package.json
 lookup

---
 packages/bundler-plugins/test/core/utils.test.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/packages/bundler-plugins/test/core/utils.test.ts b/packages/bundler-plugins/test/core/utils.test.ts
index 86171c15a827..73c28e6e646f 100644
--- a/packages/bundler-plugins/test/core/utils.test.ts
+++ b/packages/bundler-plugins/test/core/utils.test.ts
@@ -61,6 +61,21 @@ describe('getPackageJson', () => {
 
     expect(packageJson).toBeUndefined();
   });
+
+  test('it stops at the file system root when `stopAt` is never reached', () => {
+    const existsSyncSpy = vi.spyOn(fs, 'existsSync').mockReturnValue(false);
+
+    try {
+      const packageJson = getPackageJson({
+        cwd: getCwdFor('/fixtures/no-valid-package/deeply/nested'),
+        stopAt: getCwdFor('/fixtures/this-directory-is-not-an-ancestor'),
+      });
+
+      expect(packageJson).toBeUndefined();
+    } finally {
+      existsSyncSpy.mockRestore();
+    }
+  });
 });
 
 describe('parseMajorVersion', () => {