Skip to content
This repository has been archived by the owner on Oct 22, 2024. It is now read-only.

Update dependency @sentry/browser to v8.33.0 [SECURITY] #120

Draft
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 3, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@sentry/browser (source) 8.32.0 -> 8.33.0 age adoption passing confidence

GitHub Vulnerability Alerts

GHSA-593m-55hh-j8gv

Impact

In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.

Note

This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.

Patches

The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version.
Also, the fix was backported to SDK v7 in 7.119.1.

References


Release Notes

getsentry/sentry-javascript (@​sentry/browser)

v8.33.0

Compare Source

Important Changes
  • feat(nextjs): Support new async APIs (headers(), params, searchParams)
    (#​13828)

Adds support for new dynamic Next.js APIs.

  • feat(node): Add lru-memoizer instrumentation
    (#​13796)

Adds integration for lru-memoizer using @​opentelemetry/instrumentation-lru-memoizer.

  • feat(nuxt): Add unstable_sentryBundlerPluginOptions to module options
    (#​13811)

Allows passing other options from the bundler plugins (vite and rollup) to Nuxt module options.

Other Changes
  • fix(browser): Ensure wrap() only returns functions
    (#​13838)
  • fix(core): Adapt trpc middleware input attachment
    (#​13831)
  • fix(core): Don't return trace data in getTraceData and getTraceMetaTags if SDK is disabled
    (#​13760)
  • fix(nuxt): Don't restrict source map assets upload
    (#​13800)
  • fix(nuxt): Use absolute path for client config (#​13798)
  • fix(replay): Stop global event handling for paused replays
    (#​13815)
  • fix(sveltekit): add url param to source map upload options
    (#​13812)
  • fix(types): Add jsdocs to cron types (#​13776)
  • fix(nextjs): Loosen @​sentry/nextjs webpack peer dependency
    (#​13826)

Work in this release was contributed by @​joshuajaco. Thank you for your contribution!

Bundle size 📦
Path Size
@​sentry/browser 22.64 KB
@​sentry/browser - with treeshaking flags 21.42 KB
@​sentry/browser (incl. Tracing) 34.87 KB
@​sentry/browser (incl. Tracing, Replay) 71.37 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 61.8 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 75.72 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback, metrics) 90.37 KB
@​sentry/browser (incl. metrics) 26.91 KB
@​sentry/browser (incl. Feedback) 39.78 KB
@​sentry/browser (incl. sendFeedback) 27.3 KB
@​sentry/browser (incl. FeedbackAsync) 32.08 KB
@​sentry/react 25.39 KB
@​sentry/react (incl. Tracing) 37.85 KB
@​sentry/vue 26.8 KB
@​sentry/vue (incl. Tracing) 36.76 KB
@​sentry/svelte 22.77 KB
CDN Bundle 23.95 KB
CDN Bundle (incl. Tracing) 36.64 KB
CDN Bundle (incl. Tracing, Replay) 71.14 KB
CDN Bundle (incl. Tracing, Replay, Feedback) 76.45 KB
CDN Bundle - uncompressed 70.17 KB
CDN Bundle (incl. Tracing) - uncompressed 108.63 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed 220.53 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 233.74 KB
@​sentry/nextjs (client) 37.81 KB
@​sentry/sveltekit (client) 35.44 KB
@​sentry/node 125.13 KB
@​sentry/node - without tracing 93.58 KB
@​sentry/aws-serverless 103.28 KB

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Dependencies Pull requests that update a dependency file T-Task Tasks for the team like planning
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants