Skip to content

fix(deps): Address Dependabot security alerts for multiple packages #107908

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
BYK wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): Address Dependabot security alerts for multiple packages #107908

BYK wants to merge 1 commit into from
+55 −41

Conversation

@BYK
Copy link
Member

@BYK BYK commented Feb 10, 2026

Summary

  • Fixes 19 open Dependabot security alerts across Python and npm dependencies
  • Adds pnpm overrides for transitive dependency vulnerabilities
  • Bumps minimum version constraints for Django and protobuf in pyproject.toml

Changes

Python (pyproject.toml + uv.lock)

Package Change Severity Alerts Fixed
Django >=5.2.8 → >=5.2.11 3 HIGH (SQL injection), 2 MED, 3 LOW #446, #445, #444, #443, #442, #441, #423, #422
protobuf >=5.27.3 → >=5.29.6 HIGH (JSON recursion bypass) #447
Werkzeug 3.0.6 → 3.1.3 (transitive) MEDIUM (safe_join bypass) #421
filelock 3.13.1 → 3.20.3 (transitive) MEDIUM (TOCTOU race condition) #426

npm (package.json + pnpm-lock.yaml)

Package Change Severity Alerts Fixed
diff 8.0.2 → 8.0.3 (direct) LOW (DoS) #431, #432
diff transitive Override 4.x→4.0.4, 5.x→5.2.2 LOW (DoS) #438, #429
@isaacs/brace-expansion Override → 5.0.1 HIGH (ReDoS) #440
lodash (api-docs/) Override → >=4.17.23 MEDIUM (prototype pollution) #433

Blocked on PyPI mirror

uv.lock will need re-locking once getsentry/pypi#1896 merges. That PR adds Django 5.2.11, protobuf 5.29.6, h2 4.3.0, and werkzeug 3.1.5 to the Sentry PyPI mirror. Once available:

Not addressed (5 alerts)

Alert Package Reason
#436 orjson No patched version available upstream
#419, #439 pip Dev dependency, deferred
#449, #448 webpack Low severity, only exploitable via unused buildHttp feature

@BYK BYK requested review from a team as code owners February 10, 2026 00:33
@github-actions github-actions bot added Scope: Frontend Automatically applied to PRs that change frontend components Scope: Backend Automatically applied to PRs that change backend components labels Feb 10, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 10, 2026

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

@BYK BYK enabled auto-merge (squash) February 10, 2026 00:34
sentry[bot]
sentry bot reviewed Feb 10, 2026
View reviewed changes
JoshFerge
JoshFerge reviewed Feb 10, 2026
View reviewed changes
Copy link
Member

@JoshFerge JoshFerge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it worth splitting this up into multiple PRs (e.g. frontend / backend)?

cursor[bot]
cursor bot reviewed Feb 10, 2026
View reviewed changes
Copy link
Contributor

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

@BYK
Copy link
Member Author

BYK commented Feb 10, 2026

@JoshFerge don't think so as they are not interdependent

@BYK
fix(deps): Address Dependabot security alerts for multiple packages
6900441 
Python:
- Bump Django minimum to >=5.2.11 (3 HIGH SQL injection, 2 MEDIUM, 3 LOW)
- Bump protobuf minimum to >=5.29.6 (HIGH: JSON recursion depth bypass)
- Upgrade Werkzeug 3.0.6 -> 3.1.3 (MEDIUM: safe_join device name bypass)
- Upgrade filelock 3.13.1 -> 3.20.3 (MEDIUM: TOCTOU race condition)

Note: uv.lock will need re-locking once getsentry/pypi#1896 merges to
make Django 5.2.11, protobuf 5.29.6, h2 4.3.0, and werkzeug 3.1.5
available on the Sentry PyPI mirror. Until then, werkzeug 3.1.3 and
filelock 3.20.3 are the latest available versions on the mirror.

npm:
- Bump diff 8.0.2 -> 8.0.3 (LOW: DoS in parsePatch/applyPatch)
- Add pnpm override for @isaacs/brace-expansion 5.0.1 (HIGH: ReDoS)
- Add pnpm overrides for transitive diff@4.x -> 4.0.4, diff@5.x -> 5.2.2
- Add pnpm override for lodash >=4.17.23 in api-docs/ (MEDIUM: prototype pollution)
@BYK BYK force-pushed the opencode/happy-panda branch from e07456c to 6900441 Compare February 10, 2026 09:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JoshFerge JoshFerge JoshFerge left review comments

@sentry sentry[bot] sentry[bot] left review comments

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

Scope: Backend Automatically applied to PRs that change backend components Scope: Frontend Automatically applied to PRs that change frontend components

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@BYK @JoshFerge