Releases · getsentry/self-hosted

Release list

26.7.0 Latest

Latest

sentry-release-bot released this 16 Jul 10:44

26.7.0

756c817

Important

This is a hard stop. This release includes security fixes and a migration squash — you must update to this version before moving on to any later version. Details on what hard stops mean and why they exist are in the documentation.

There's also a feature flag configuration change in sentry/sentry.conf.py — make sure to update that as part of this upgrade, or things will not behave the way you expect.

Full diff from 26.6.0 to 26.7.0 is here if you want to see exactly what's changing before you pull the trigger.

Less containers, thanks Taskbroker!

We're down a few more containers this release, courtesy of continued work on Taskbroker. The Sentry subscription consumers, and ingest-profiles specifically, have now moved off their dedicated consumer processes and into Taskbroker tasks, which Taskworker executes instead. Fewer long-running consumer containers, same work getting done — just routed through the task system now.

If you're running a setup where you need to scale these workloads out, the Tasks documentation covers how that works under this new model.

SeaweedFS changes to `weed mini`

We'd been running SeaweedFS via weed server with the all-in-one flag, but that mode doesn't include the Admin and Worker services. We've moved to weed mini, which bundles those in, and that gets us two more containers down in the process. This wasn't just a container-count win either — it fixes object retention and cleanup, which the all-in-one setup couldn't handle correctly. A handful of users tested this ahead of release and reported no issues, but if you hit something unexpected with retention behavior post-upgrade, let us know.

Security Fixes

Warning

⚠️ Security Advisory: This release patches GHSA-5r6f-q5fc-7r23 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in snuba. If EAP array-attribute feature is enabled, this is a required update.
⚠️ Security Advisory: This release patches GHSA-xm86-7c47-gjm4 — Unsafe pickle deserialization in Relocation Feature. If you are using the relocation feature, this is a required update.

Notable changes

There's now a Troubleshooting Snuba page in the docs, if you've ever had to dig through Snuba issues blind, this should help.
The Data Flow documentation has been updated to reflect how the system actually looks today.
pgbouncer, nginx, and memcached all got bumped, and we've got Dependabot handling this class of chore going forward, so expect these to stay current with less manual intervention on our end.
There's an open pull request for a premade Grafana dashboard. We're not merging it into this repo — it'll live in its own repository down the line — but the dashboard works today, so feel free to grab it from the PR in the meantime.

As always, back up before you upgrade, and give the hard stop docs a read if you're unsure whether this affects your upgrade path. If you run into anything, or just want to talk through your setup, we're always happy to chat on Discord.

New Features ✨

Taskbroker

Port subscriptions consumers to tasks by @lvthanh03 in #4395
Port profiles consumer to taskbroker raw mode by @untitaker in #4386

Other

(deps) Bump seaweedfs to 4.29 and migrate into weed mini by @aldy505 in #4345
Add in transactions -> spans migration flags by @nikkikapadia in #4402
Enable workflow engine by @aldy505 in #4364

Bug Fixes 🐛

(relay) Disable DNS caching by @aldy505 in #4213

Internal Changes 🔧

Deps

Bump memcached from 1.6.26-alpine to 1.6.45-alpine by @dependabot in #4412
Bump soupsieve from 2.8 to 2.8.4 by @dependabot in #4406
Bump nginx from 1.31.0-alpine to 1.31.2-alpine by @dependabot in #4411
Bump astral-sh/setup-uv from 8.2.0 to 8.3.0 by @dependabot in #4399
Bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot in #4390
Bump j178/prek-action from 2.0.4 to 2.0.5 by @dependabot in #4400
Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #4383
Bump @opentelemetry/core and @sentry/node in /_integration-test/nodejs by @dependabot in #4380

Other

(deps-dev) Bump cryptography from 46.0.7 to 48.0.1 by @dependabot in #4382
Add memcached integration test by @aminvakil in #4414

Other

Upgrade docker images using dependabot by @aminvakil in #4407
Increase web healthcheck start_period by @aminvakil in #4387
Bump pgbouncer 1.25.2-p0 by @aminvakil in #4384

Contributors

untitaker, aldy505, and 4 other contributors

Assets 2

26.6.0

sentry-release-bot released this 16 Jun 01:31

26.6.0

4c9ceba

Important

26.5.0 is a hard stop. If you're upgrading from an older version, visit that release first before continuing.

Taskbroker Now Uses a Config File

Taskbroker has moved from pure environment variables to a config file, and with that comes the ability to consume multiple topics on a single taskbroker container. If you're running a standard setup, you're fine. But if you've configured separate ingest workers as described in the docs, this is a breaking change for you — the old env var approach won't work. Check the migration guide for what needs to change.

Mandatory Email Verification

Sentry now requires emails to be verified before they're added to a user. If you're running an external SMTP server, nothing changes on your end. If you've been using the dummy mail backend, this is the nudge to properly configure email — secondary verification means outbound mail now actually needs to work. Revisit the email configuration docs to get that sorted.

Increased `proxy_read_timeout` on nginx (30s → 90s)

If you're seeing slow or timing-out requests in the web UI — particularly around EAP features like spans, metrics, logs, and uptime checks — this is likely why. Snuba is doing heavier lifting querying that data, and since we moved from uWSGI to Granian, there's no HTTP server-level timeout to catch long-running requests, so they keep executing in the background. Bumping the nginx timeout to 90s is a reasonable mitigation, but if you're handling significant traffic or still hitting timeouts, you may want to push proxy_read_timeout higher and restart the nginx container.