Skip to content

chore(deps): update dependency sentry-sdk to v1.45.1 [security] #236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency sentry-sdk to v1.45.1 [security] #236

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jul 18, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
sentry-sdk (changelog) ==1.39.1 → ==1.45.1 age confidence

GitHub Vulnerability Alerts

CVE-2024-40647

Impact

The bug in Sentry's Python SDK <2.8.0 results in the unintentional exposure of environment variables to subprocesses despite the env={} setting.

Details

In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use env argument in subprocess calls, like in this example:

>>> subprocess.check_output(["env"], env={"TEST":"1"})
b'TEST=1\n'

If you'd want to not pass any variables, you can set an empty dict:

>>> subprocess.check_output(["env"], env={})
b''

However, the bug in Sentry SDK <2.8.0 causes all environment variables to be passed to the subprocesses when env={} is set, unless the Sentry SDK's Stdlib integration is disabled. The Stdlib integration is enabled by default.

Patches

The issue has been patched in https://github.com/getsentry/sentry-python/pull/3251 and the fix released in sentry-sdk==2.8.0. The fix was also backported to sentry-sdk==1.45.1.

Workarounds

We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, there are two options:

  1. In your application, replace env={} with the minimal dict env={"EMPTY_ENV":"1"} or similar.

OR

  1. Disable Stdlib integration:
import sentry_sdk

# Should go before sentry_sdk.init
sentry_sdk.integrations._DEFAULT_INTEGRATIONS.remove("sentry_sdk.integrations.stdlib.StdlibIntegration")

sentry_sdk.init(...)

References

Release Notes

getsentry/sentry-python (sentry-sdk)

v1.45.1

Compare Source

This is a security backport release.

v1.45.0

Compare Source

This is the final 1.x release for the forseeable future. Development will continue on the 2.x release line. The first 2.x version will be available in the next few weeks.

Various fixes & improvements

  • Allow to upsert monitors (#​2929) by @​sentrivana

    It's now possible to provide monitor_config to the monitor decorator/context manager directly:

    from sentry_sdk.crons import monitor

# All keys except `schedule` are optional
monitor_config = {
    "schedule": {"type": "crontab", "value": "0 0 * * *"},
    "timezone": "Europe/Vienna",
    "checkin_margin": 10,
    "max_runtime": 10,
    "failure_issue_threshold": 5,
    "recovery_threshold": 5,
}

@&#8203;monitor(monitor_slug='<monitor-slug>', monitor_config=monitor_config)
def tell_the_world():
    print('My scheduled task...')

    Check out the cron docs for details.

  • Add Django signals_denylist to filter signals that are attached to by signals_spans (#​2758) by @​lieryan

    If you want to exclude some Django signals from performance tracking, you can use the new signals_denylist Django option:

    import django.db.models.signals
import sentry_sdk

sentry_sdk.init(
    ...
    integrations=[
        DjangoIntegration(
            ...
            signals_denylist=[
                django.db.models.signals.pre_init,
                django.db.models.signals.post_init,
            ],
        ),
    ],
)

  • increment for metrics (#​2588) by @​mitsuhiko

    increment and inc are equivalent, so you can pick whichever you like more.

  • Add value, unit to before_emit_metric (#​2958) by @​sentrivana

    If you add a custom before_emit_metric, it'll now accept 4 arguments (the key, value, unit and tags) instead of just key and tags.

    def before_emit(key, value, unit, tags):
    if key == "removed-metric":
        return False
    tags["extra"] = "foo"
    del tags["release"]
    return True

sentry_sdk.init(
    ...
    _experiments={
        "before_emit_metric": before_emit,
    }
)

  • Remove experimental metric summary options (#​2957) by @​sentrivana

    The _experiments options metrics_summary_sample_rate and should_summarize_metric have been removed.

  • New normalization rules for metric keys, names, units, tags (#​2946) by @​sentrivana

  • Change data_category from statsd to metric_bucket (#​2954) by @​cleptric

  • Accessing __mro__ might throw a ValueError (#​2952) by @​sentrivana

  • Suppress prompt spawned by subprocess when using pythonw (#​2936) by @​collinbanko

  • Handle None in GraphQL query #​2715 (#​2762) by @​czyber

  • Do not send "quiet" Sanic exceptions to Sentry (#​2821) by @​hamedsh

  • Implement metric_bucket rate limits (#​2933) by @​cleptric

  • Fix type hints for monitor decorator (#​2944) by @​szokeasaurusrex

  • Remove deprecated typing imports in crons (#​2945) by @​szokeasaurusrex

  • Make monitor_config a TypedDict (#​2931) by @​sentrivana

  • Add devenv-requirements.txt and update env setup instructions (#​2761) by @​arr-ee

  • Bump types-protobuf from 4.24.0.20240311 to 4.24.0.20240408 (#​2941) by @​dependabot

  • Disable Codecov check run annotations (#​2537) by @​eliatcodecov

v1.44.1

Compare Source

Various fixes & improvements

  • Make monitor async friendly (#​2912) by @​sentrivana

    You can now decorate your async functions with the monitor
    decorator and they will correctly report their duration
    and completion status.

  • Fixed Event | None runtime TypeError (#​2928) by @​szokeasaurusrex

v1.44.0

Compare Source

Various fixes & improvements

v1.43.0

Compare Source

Various fixes & improvements

v1.42.0

Compare Source

Various fixes & improvements

  • New integration: OpenAI integration (#​2791) by @​colin-sentry

    We added an integration for OpenAI to capture errors and also performance data when using the OpenAI Python SDK.

    Useage:

    This integrations is auto-enabling, so if you have the openai package in your project it will be enabled. Just initialize Sentry before you create your OpenAI client.

    from openai import OpenAI

import sentry_sdk

sentry_sdk.init(
    dsn="___PUBLIC_DSN___",
    enable_tracing=True,
    traces_sample_rate=1.0,
)

client = OpenAI()

    For more information, see the documentation for OpenAI integration.

  • Discard open OpenTelemetry spans after 10 minutes (#​2801) by @​antonpirker

  • Propagate sentry-trace and baggage headers to Huey tasks (#​2792) by @​cnschn

  • Added Event type (#​2753) by @​szokeasaurusrex

  • Improve scrub_dict typing (#​2768) by @​szokeasaurusrex

  • Dependencies: bump types-protobuf from 4.24.0.20240302 to 4.24.0.20240311 (#​2797) by @​dependabot

v1.41.0

Compare Source

Various fixes & improvements

  • Add recursive scrubbing to EventScrubber (#​2755) by @​Cheapshot003

    By default, the EventScrubber will not search your events for potential
    PII recursively. With this release, you can enable this behavior with:

    import sentry_sdk
from sentry_sdk.scrubber import EventScrubber

sentry_sdk.init(
    # ...your usual settings...
    event_scrubber=EventScrubber(recursive=True),
)

  • Expose socket_options (#​2786) by @​sentrivana

    If the SDK is experiencing connection issues (connection resets, server
    closing connection without response, etc.) while sending events to Sentry,
    tweaking the default urllib3 socket options to the following can help:

    import socket
from urllib3.connection import HTTPConnection
import sentry_sdk

sentry_sdk.init(
    # ...your usual settings...
    socket_options=HTTPConnection.default_socket_options + [
        (socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1),
        # note: skip the following line if you're on MacOS since TCP_KEEPIDLE doesn't exist there
        (socket.SOL_TCP, socket.TCP_KEEPIDLE, 45),
        (socket.SOL_TCP, socket.TCP_KEEPINTVL, 10),
        (socket.SOL_TCP, socket.TCP_KEEPCNT, 6),
    ],
)

  • Allow to configure merge target for releases (#​2777) by @​sentrivana

  • Allow empty character in metric tags values (#​2775) by @​viglia

  • Replace invalid tag values with an empty string instead of _ (#​2773) by @​markushi

  • Add documentation comment to scrub_list (#​2769) by @​szokeasaurusrex

  • Fixed regex to parse version in lambda package file (#​2767) by @​antonpirker

  • xfail broken AWS Lambda tests for now (#​2794) by @​sentrivana

  • Removed print statements because it messes with the tests (#​2789) by @​antonpirker

  • Bump types-protobuf from 4.24.0.20240129 to 4.24.0.20240302 (#​2782) by @​dependabot

  • Bump checkouts/data-schemas from eb941c2 to ed078ed (#​2781) by @​dependabot

v1.40.6

Compare Source

Various fixes & improvements

v1.40.5

Compare Source

Various fixes & improvements

  • Deprecate last_event_id(). (#​2749) by @​antonpirker

  • Warn if uWSGI is set up without proper thread support (#​2738) by @​sentrivana

    uWSGI has to be run in threaded mode for the SDK to run properly. If this is
    not the case, the consequences could range from features not working unexpectedly
    to uWSGI workers crashing.

    Please make sure to run uWSGI with both --enable-threads and --py-call-uwsgi-fork-hooks.

  • parsed_url can be None (#​2734) by @​sentrivana

  • Python 3.7 is not supported anymore by Lambda, so removed it and added 3.12 (#​2729) by @​antonpirker

v1.40.4

Compare Source

Various fixes & improvements

v1.40.3

Compare Source

Various fixes & improvements

v1.40.2

Compare Source

Various fixes & improvements

v1.40.1

Compare Source

Various fixes & improvements

v1.40.0

Compare Source

Various fixes & improvements

v1.39.2

Compare Source

Various fixes & improvements

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added area/security Issue or PR related to security priority/critical Issue or PR categorized as being critical/urgent to solve type/dependencies Issue or PR related to dependencies labels Jul 18, 2024
@renovate renovate bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch 4 times, most recently from c41e6a6 to 377c559 Compare November 15, 2024 01:09
@renovate renovate bot changed the title chore(deps): update dependency sentry-sdk to v2 [security] chore(deps): update dependency sentry-sdk to v1.45.1 [security] Jun 6, 2025
@renovate renovate bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch from 377c559 to 14b71a5 Compare June 6, 2025 23:06
@renovate renovate bot force-pushed the renovate/pypi-sentry-sdk-vulnerability branch from 14b71a5 to e78ac57 Compare September 11, 2025 14:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/security Issue or PR related to security priority/critical Issue or PR categorized as being critical/urgent to solve type/dependencies Issue or PR related to dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant