This repository was archived by the owner on Oct 12, 2023. It is now read-only.
Update dependency sentry-sdk to v1 [SECURITY] - #239
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/pypi-sentry-sdk-vulnerability
branch
from
March 24, 2023 08:08
e3ae7f7 to
432221f
Compare
renovate
Bot
force-pushed
the
renovate/pypi-sentry-sdk-vulnerability
branch
from
March 24, 2023 08:08
432221f to
21c7511
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.20.3->==1.14.0GitHub Vulnerability Alerts
CVE-2023-28117
Impact
When using the Django integration of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application.
The below must be true in order for these sensitive values to be leaked:
sendDefaultPIIset toTrueSESSION_COOKIE_NAMEorCSRF_COOKIE_NAMEDjango settingsPatches
As of version
1.14.0, the Django integration of thesentry-sdkwill detect the custom cookie names based on your Django settings and will remove the values from the payload before sending the data to Sentry.Workarounds
If you can not update your
sentry-sdkto a patched version than you can use the SDKs filtering mechanism to remove the cookies from the payload that is sent to Sentry. For error events this can be done with the before_send callback method and for performance related events (transactions) you can use the before_send_transaction callback method.If you'd like to handle filtering of these values on the server-side, you can also use our advanced data scrubbing feature to account for the custom cookie names. Look for the
$http.cookies,$http.headers,$request.cookies, or$request.headersfields to target with your scrubbing rule.References
Credits
Release Notes
getsentry/sentry-python (sentry-sdk)
v1.14.0Compare Source
Various fixes & improvements
Add
before_send_transaction(#1840) by @antonpirkerAdds a hook (similar to
before_send) that is called for all transaction events (performance releated data).Usage:
modify event here (or return
Noneif you want to drop the event entirely)...
v1.13.0Compare Source
Various fixes & improvements
Add Starlite integration (#1748) by @gazorby
Adding support for the Starlite framework. Unhandled errors are captured. Performance spans for Starlite middleware are also captured. Thanks @gazorby for the great work!
Usage:
Profiling: Remove sample buffer from profiler (#1791) by @Zylphrex
Profiling: Performance tweaks to profile sampler (#1789) by @Zylphrex
Add span for Django SimpleTemplateResponse rendering (#1818) by @chdsbd
Use @wraps for Django Signal receivers (#1815) by @meanmail
Add enqueued_at and started_at to rq job extra (#1024) by @kruvasyan
Remove sanic v22 pin (#1819) by @sl0thentr0py
Add support for
byterrayandmemoryviewbuilt-in types (#1833) by @TartyHandle
"rc"in SQLAlchemy version. (#1812) by @peterschuttDoc: Use .venv (not .env) as a virtual env location in CONTRIBUTING.md (#1790) by @tonyo
Auto publish to internal pypi on release (#1823) by @asottile-sentry
Added Python 3.11 to test suite (#1795) by @antonpirker
Update test/linting dependencies (#1801) by @antonpirker
Deps: bump sphinx from 5.2.3 to 5.3.0 (#1686) by @dependabot
v1.12.1Compare Source
Various fixes & improvements
v1.12.0Compare Source
Basic OTel support
This adds support to automatically integrate OpenTelemetry performance tracing with Sentry.
See the documentation on how to set it up:
https://docs.sentry.io/platforms/python/performance/instrumentation/opentelemetry/
Give it a try and let us know if you have any feedback or problems with using it.
By: @antonpirker (#1772, #1766, #1765)
Various fixes & improvements
v1.11.1Compare Source
Various fixes & improvements
v1.11.0Compare Source
Various fixes & improvements
a214fbcto20ff3b9(#1703) by @dependabotv1.10.1Compare Source
Various fixes & improvements
v1.10.0Compare Source
Various fixes & improvements
Unified naming for span ops (#1661) by @antonpirker
We have unified the strings of our span operations. See https://develop.sentry.dev/sdk/performance/span-operations/
WARNING: If you have Sentry Dashboards or Sentry Discover queries that use
transaction.opin their fields, conditions, aggregates or columns this change could potentially break your Dashboards/Discover setup.Here is a list of the changes we made to the
ops. Please adjust your dashboards and Discover queries accordingly:op)op)asgi.serverhttp.serveraws.requesthttp.clientaws.request.streamhttp.client.streamcelery.submitqueue.submit.celerycelery.taskqueue.task.celerydjango.middlewaremiddleware.djangodjango.signalsevent.djangodjango.template.rendertemplate.renderdjango.viewview.renderhttphttp.clientredisdb.redisrq.taskqueue.task.rqserverless.functionfunction.awsserverless.functionfunction.gcpstarlette.middlewaremiddleware.starletteInclude framework in SDK name (#1662) by @antonpirker
Asyncio integration (#1671) by @antonpirker
Add exception handling to Asyncio Integration (#1695) by @antonpirker
Fix asyncio task factory (#1689) by @antonpirker
Have instrumentation for ASGI middleware receive/send callbacks. (#1673) by @antonpirker
Use Django internal ASGI handling from Channels version 4.0.0. (#1688) by @antonpirker
fix(integrations): Fix http putrequest when url is None (#1693) by @MattFlower
build(deps): bump checkouts/data-schemas from
f0a57f2toa214fbc(#1627) by @dependabotbuild(deps): bump flake8-bugbear from 22.9.11 to 22.9.23 (#1637) by @dependabot
build(deps): bump sphinx from 5.1.1 to 5.2.3 (#1653) by @dependabot
build(deps): bump actions/stale from 5 to 6 (#1638) by @dependabot
build(deps): bump black from 22.8.0 to 22.10.0 (#1670) by @dependabot
Remove unused node setup from ci. (#1681) by @antonpirker
Check for Decimal is in_valid_sample_rate (#1672) by @Arvind2222
Add session for aiohttp integration (#1605) by @denys-pidlisnyi
feat(profiling): Extract qualified name for each frame (#1669) by @Zylphrex
feat(profiling): Attach thread metadata to profiles (#1660) by @Zylphrex
ref(profiling): Rename profiling frame keys (#1680) by @Zylphrex
fix(profiling): get_frame_name only look at arguments (#1684) by @Zylphrex
fix(profiling): Need to sample profile correctly (#1679) by @Zylphrex
fix(profiling): Race condition spawning multiple profiling threads (#1676) by @Zylphrex
tests(profiling): Add basic profiling tests (#1677) by @Zylphrex
tests(profiling): Add tests for thread schedulers (#1683) by @Zylphrex
v1.9.10Compare Source
Various fixes & improvements
v1.9.9Compare Source
Django update (ongoing)
Various fixes & improvements
v1.9.8Compare Source
Various fixes & improvements
v1.9.7Compare Source
Various fixes & improvements
Note: The last version 1.9.6 introduced a breaking change where projects that used Starlette or FastAPI
and had manually setup
SentryAsgiMiddlewarecould not start. This versions fixes this behaviour.With this version if you have a manual
SentryAsgiMiddlewaresetup and are using Starlette or FastAPIeverything just works out of the box.
Sorry for any inconveniences the last version might have brought to you.
We can do better and in the future we will do our best to not break your code again.
v1.9.6Compare Source
Various fixes & improvements
v1.9.5Compare Source
Various fixes & improvements
v1.9.4Compare Source
Various fixes & improvements
v1.9.3Compare Source
Various fixes & improvements
v1.9.2Compare Source
Various fixes & improvements
v1.9.1Compare Source
Various fixes & improvements
v1.9.0Compare Source
Various fixes & improvements
v1.8.0Compare Source
Various fixes & improvements
feat(starlette): add Starlette integration (#1441) by @sl0thentr0py
Important: Remove manual usage of
SentryAsgiMiddleware! This is now done by the Starlette integration.Usage:
feat(fastapi): add FastAPI integration (#829) by @antonpirker
Important: Remove manual usage of
SentryAsgiMiddleware! This is now done by the FastAPI integration.Usage:
Yes, you have to add both, the
StarletteIntegrationAND theFastApiIntegration!fix: avoid sending empty Baggage header (#1507) by @intgr
fix: properly freeze Baggage object (#1508) by @intgr
docs: fix simple typo, collecter | collector (#1505) by @timgates42
v1.7.2Compare Source
Various fixes & improvements
v1.7.1Compare Source
Various fixes & improvements
v1.7.0Compare Source
Various fixes & improvements
feat(tracing): Dynamic Sampling Context / Baggage continuation (#1485) by @sl0thentr0py
The SDK now propagates the W3C Baggage Header from
incoming transactions to outgoing requests.
It also extracts Sentry specific sampling information
and adds it to the transaction headers to enable Dynamic Sampling in the product.
v1.6.0Compare Source
Various fixes & improvements
v1.5.12Compare Source
Various fixes & improvements
v1.5.11Compare Source
Various fixes & improvements
v1.5.10Compare Source
Various fixes & improvements
v1.5.9Compare Source
Various fixes & improvements
v1.5.8Compare Source
Various fixes & improvements
v1.5.7Compare Source
Various fixes & improvements
v1.5.6Compare Source
Various fixes & improvements
sentry_trace()template helper (#1336) by @BYKv1.5.5Compare Source
sentry_repr(#1322)Work in this release contributed by @tomchuk. Thank you for your contribution!
v1.5.4Compare Source
got_request_exceptionas well (#1317)v1.5.3Compare Source
v1.5.2Compare Source
Work in this release contributed by @johnzeringue, @pgjones and @ahopkins. Thank you for your contribution!
v1.5.1Compare Source
Various fixes & improvements
v1.5.0Compare Source
Work in this release contributed by @galuszkak, @kianmeng, @ahopkins, @razumeiko, @tomscytale, and @seedofjoy. Thank you for your contribution!
v1.4.3Compare Source
v1.4.2Compare Source
v1.4.1Compare Source
finishandstart_childin tracing #1203v1.4.0Compare Source
tracestateheader handling #1179v1.3.1Compare Source
v1.3.0Compare Source
v1.2.0Compare Source
AWSLambdaIntegration to handle other path formats for function initial handler #1139bottleIntegration that discards-devfor version extraction #1085HttpxIntegration #1119AWSLambdaIntegration #1051v1.1.0Compare Source
AWSLambdaintegration returns value of original handler #1106RQintegration that only captures exception if RQ job has failed and ignore retries #1076Tornadointegration #1060ignore_loggerin theLoggingIntegration #1053v1.0.0Compare Source
This release contains a breaking change
auto_session_trackingexperimental flag to a proper option and removed explicitly setting experimentalsession_modein favor of auto detecting its value, hence enabling release health by default #994request.path_inforather thanrequest.pathX-Forwarded-Forheader #1037Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.