Update dependency sentry-sdk to v2.8.0 [SECURITY]

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sentry-sdk (changelog)	==2.2.0 -> ==2.8.0

GitHub Vulnerability Alerts

CVE-2024-40647

Impact

The bug in Sentry's Python SDK <2.8.0 results in the unintentional exposure of environment variables to subprocesses despite the env={} setting.

Details

In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use env argument in subprocess calls, like in this example:

>>> subprocess.check_output(["env"], env={"TEST":"1"})
b'TEST=1\n'

If you'd want to not pass any variables, you can set an empty dict:

>>> subprocess.check_output(["env"], env={})
b''

However, the bug in Sentry SDK <2.8.0 causes all environment variables to be passed to the subprocesses when env={} is set, unless the Sentry SDK's Stdlib integration is disabled. The Stdlib integration is enabled by default.

Patches

The issue has been patched in https://github.com/getsentry/sentry-python/pull/3251 and the fix released in sentry-sdk==2.8.0. The fix was also backported to sentry-sdk==1.45.1.

Workarounds

We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, there are two options:

1. In your application, replace env={} with the minimal dict env={"EMPTY_ENV":"1"} or similar.

OR

2. Disable Stdlib integration:

   
   import sentry_sdk

Should go before sentry_sdk.init

sentry_sdk.integrations._DEFAULT_INTEGRATIONS.remove("sentry_sdk.integrations.stdlib.StdlibIntegration")

sentry_sdk.init(...)

### References
* Sentry docs: [Default integrations](https://docs.sentry.io/platforms/python/integrations/default-integrations/)
* Python docs: [subprocess module](https://docs.python.org/3/library/subprocess.html)
* Patch [https://github.com/getsentry/sentry-python/pull/3251](https://redirect.github.com/getsentry/sentry-python/pull/3251)

---

### Release Notes

<details>
<summary>getsentry/sentry-python (sentry-sdk)</summary>

### [`v2.8.0`](https://redirect.github.com/getsentry/sentry-python/blob/HEAD/CHANGELOG.md#280)

[Compare Source](https://redirect.github.com/getsentry/sentry-python/compare/2.7.1...2.8.0)

##### Various fixes & improvements

-   `profiler_id` uses underscore ([#&#8203;3249](https://redirect.github.com/getsentry/sentry-python/issues/3249)) by [@&#8203;Zylphrex](https://redirect.github.com/Zylphrex)
-   Don't send full env to subprocess ([#&#8203;3251](https://redirect.github.com/getsentry/sentry-python/issues/3251)) by [@&#8203;kmichel-aiven](https://redirect.github.com/kmichel-aiven)
-   Stop using `Hub` in `HttpTransport` ([#&#8203;3247](https://redirect.github.com/getsentry/sentry-python/issues/3247)) by [@&#8203;szokeasaurusrex](https://redirect.github.com/szokeasaurusrex)
-   Remove `ipdb` from test requirements ([#&#8203;3237](https://redirect.github.com/getsentry/sentry-python/issues/3237)) by [@&#8203;rominf](https://redirect.github.com/rominf)
-   Avoid propagation of empty baggage ([#&#8203;2968](https://redirect.github.com/getsentry/sentry-python/issues/2968)) by [@&#8203;hartungstenio](https://redirect.github.com/hartungstenio)
-   Add entry point for `SentryPropagator` ([#&#8203;3086](https://redirect.github.com/getsentry/sentry-python/issues/3086)) by [@&#8203;mender](https://redirect.github.com/mender)
-   Bump checkouts/data-schemas from `8c13457` to `88273a9` ([#&#8203;3225](https://redirect.github.com/getsentry/sentry-python/issues/3225)) by [@&#8203;dependabot](https://redirect.github.com/dependabot)

### [`v2.7.1`](https://redirect.github.com/getsentry/sentry-python/blob/HEAD/CHANGELOG.md#271)

[Compare Source](https://redirect.github.com/getsentry/sentry-python/compare/2.7.0...2.7.1)

##### Various fixes & improvements

-   fix(otel): Fix missing baggage ([#&#8203;3218](https://redirect.github.com/getsentry/sentry-python/issues/3218)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   This is the config file of asdf-vm which we do not use. ([#&#8203;3215](https://redirect.github.com/getsentry/sentry-python/issues/3215)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   Added option to disable middleware spans in Starlette ([#&#8203;3052](https://redirect.github.com/getsentry/sentry-python/issues/3052)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   build: Update tornado version in setup.py to match code check. ([#&#8203;3206](https://redirect.github.com/getsentry/sentry-python/issues/3206)) by [@&#8203;aclemons](https://redirect.github.com/aclemons)

### [`v2.7.0`](https://redirect.github.com/getsentry/sentry-python/blob/HEAD/CHANGELOG.md#270)

[Compare Source](https://redirect.github.com/getsentry/sentry-python/compare/2.6.0...2.7.0)

-   Add `origin` to spans and transactions ([#&#8203;3133](https://redirect.github.com/getsentry/sentry-python/issues/3133)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   OTel: Set up typing for OTel ([#&#8203;3168](https://redirect.github.com/getsentry/sentry-python/issues/3168)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   OTel: Auto instrumentation skeleton ([#&#8203;3143](https://redirect.github.com/getsentry/sentry-python/issues/3143)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   OpenAI: If there is an internal error, still return a value ([#&#8203;3192](https://redirect.github.com/getsentry/sentry-python/issues/3192)) by [@&#8203;colin-sentry](https://redirect.github.com/colin-sentry)
-   MongoDB: Add MongoDB collection span tag ([#&#8203;3182](https://redirect.github.com/getsentry/sentry-python/issues/3182)) by [@&#8203;0Calories](https://redirect.github.com/0Calories)
-   MongoDB: Change span operation from `db.query` to `db` ([#&#8203;3186](https://redirect.github.com/getsentry/sentry-python/issues/3186)) by [@&#8203;0Calories](https://redirect.github.com/0Calories)
-   MongoDB: Remove redundant command name in query description ([#&#8203;3189](https://redirect.github.com/getsentry/sentry-python/issues/3189)) by [@&#8203;0Calories](https://redirect.github.com/0Calories)
-   Apache Spark: Fix spark driver integration ([#&#8203;3162](https://redirect.github.com/getsentry/sentry-python/issues/3162)) by [@&#8203;seyoon-lim](https://redirect.github.com/seyoon-lim)
-   Apache Spark: Add Spark test suite to tox.ini and to CI ([#&#8203;3199](https://redirect.github.com/getsentry/sentry-python/issues/3199)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   Codecov: Add failed test commits in PRs ([#&#8203;3190](https://redirect.github.com/getsentry/sentry-python/issues/3190)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   Update library, Python versions in tests ([#&#8203;3202](https://redirect.github.com/getsentry/sentry-python/issues/3202)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   Remove Hub from our test suite ([#&#8203;3197](https://redirect.github.com/getsentry/sentry-python/issues/3197)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   Use env vars for default CA cert bundle location ([#&#8203;3160](https://redirect.github.com/getsentry/sentry-python/issues/3160)) by [@&#8203;DragoonAethis](https://redirect.github.com/DragoonAethis)
-   Create a separate test group for AI ([#&#8203;3198](https://redirect.github.com/getsentry/sentry-python/issues/3198)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   Add additional stub packages for type checking ([#&#8203;3122](https://redirect.github.com/getsentry/sentry-python/issues/3122)) by [@&#8203;Daverball](https://redirect.github.com/Daverball)
-   Proper naming of requirements files ([#&#8203;3191](https://redirect.github.com/getsentry/sentry-python/issues/3191)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   Pinning pip because new version does not work with some versions of Celery and Httpx ([#&#8203;3195](https://redirect.github.com/getsentry/sentry-python/issues/3195)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   build(deps): bump supercharge/redis-github-action from 1.7.0 to 1.8.0 ([#&#8203;3193](https://redirect.github.com/getsentry/sentry-python/issues/3193)) by [@&#8203;dependabot](https://redirect.github.com/dependabot)
-   build(deps): bump actions/checkout from 4.1.6 to 4.1.7 ([#&#8203;3171](https://redirect.github.com/getsentry/sentry-python/issues/3171)) by [@&#8203;dependabot](https://redirect.github.com/dependabot)
-   build(deps): update pytest-asyncio requirement ([#&#8203;3087](https://redirect.github.com/getsentry/sentry-python/issues/3087)) by [@&#8203;dependabot](https://redirect.github.com/dependabot)

### [`v2.6.0`](https://redirect.github.com/getsentry/sentry-python/blob/HEAD/CHANGELOG.md#260)

[Compare Source](https://redirect.github.com/getsentry/sentry-python/compare/2.5.1...2.6.0)

-   Introduce continuous profiling mode ([#&#8203;2830](https://redirect.github.com/getsentry/sentry-python/issues/2830)) by [@&#8203;Zylphrex](https://redirect.github.com/Zylphrex)
-   Profiling: Add deprecation comment for profiler internals ([#&#8203;3167](https://redirect.github.com/getsentry/sentry-python/issues/3167)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   Profiling: Move thread data to trace context ([#&#8203;3157](https://redirect.github.com/getsentry/sentry-python/issues/3157)) by [@&#8203;Zylphrex](https://redirect.github.com/Zylphrex)
-   Explicitly export cron symbols for typecheckers ([#&#8203;3072](https://redirect.github.com/getsentry/sentry-python/issues/3072)) by [@&#8203;spladug](https://redirect.github.com/spladug)
-   Cleaning up ASGI tests for Django ([#&#8203;3180](https://redirect.github.com/getsentry/sentry-python/issues/3180)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   Celery: Add Celery receive latency ([#&#8203;3174](https://redirect.github.com/getsentry/sentry-python/issues/3174)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   Metrics: Update type hints for tag values ([#&#8203;3156](https://redirect.github.com/getsentry/sentry-python/issues/3156)) by [@&#8203;elramen](https://redirect.github.com/elramen)
-   Django: Fix psycopg3 reconnect error ([#&#8203;3111](https://redirect.github.com/getsentry/sentry-python/issues/3111)) by [@&#8203;szokeasaurusrex](https://redirect.github.com/szokeasaurusrex)
-   Tracing: Keep original function signature when decorated ([#&#8203;3178](https://redirect.github.com/getsentry/sentry-python/issues/3178)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)
-   Reapply "Refactor the Celery Beat integration ([#&#8203;3105](https://redirect.github.com/getsentry/sentry-python/issues/3105))" ([#&#8203;3144](https://redirect.github.com/getsentry/sentry-python/issues/3144)) ([#&#8203;3175](https://redirect.github.com/getsentry/sentry-python/issues/3175)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   Added contributor image to readme ([#&#8203;3183](https://redirect.github.com/getsentry/sentry-python/issues/3183)) by [@&#8203;antonpirker](https://redirect.github.com/antonpirker)
-   bump actions/checkout from 4.1.4 to 4.1.6 ([#&#8203;3147](https://redirect.github.com/getsentry/sentry-python/issues/3147)) by [@&#8203;dependabot](https://redirect.github.com/dependabot)
-   bump checkouts/data-schemas from `59f9683` to `8c13457` ([#&#8203;3146](https://redirect.github.com/getsentry/sentry-python/issues/3146)) by [@&#8203;dependabot](https://redirect.github.com/dependabot)

### [`v2.5.1`](https://redirect.github.com/getsentry/sentry-python/blob/HEAD/CHANGELOG.md#251)

[Compare Source](https://redirect.github.com/getsentry/sentry-python/compare/2.5.0...2.5.1)

This change fixes a regression in our cron monitoring feature, which caused cron checkins not to be sent. The regression appears to have been introduced in version 2.4.0.

**We recommend that all users, who use Cron monitoring and are currently running sentry-python ≥2.4.0, upgrade to this release as soon as possible!**

##### Other fixes & improvements

-   feat(tracing): Warn if not-started transaction entered ([#&#8203;3003](https://redirect.github.com/getsentry/sentry-python/issues/3003)) by [@&#8203;szokeasaurusrex](https://redirect.github.com/szokeasaurusrex)
-   test(scope): Ensure `last_event_id` cleared ([#&#8203;3124](https://redirect.github.com/getsentry/sentry-python/issues/3124)) by [@&#8203;szokeasaurusrex](https://redirect.github.com/szokeasaurusrex)
-   fix(scope): Clear last_event_id on scope clear ([#&#8203;3124](https://redirect.github.com/getsentry/sentry-python/issues/3124)) by [@&#8203;szokeasaurusrex](https://redirect.github.com/szokeasaurusrex)

### [`v2.5.0`](https://redirect.github.com/getsentry/sentry-python/blob/HEAD/CHANGELOG.md#250)

[Compare Source](https://redirect.github.com/getsentry/sentry-python/compare/2.4.0...2.5.0)

##### Various fixes & improvements

-   Allow to configure status codes to report to Sentry in Starlette and FastAPI ([#&#8203;3008](https://redirect.github.com/getsentry/sentry-python/issues/3008)) by [@&#8203;sentrivana](https://redirect.github.com/sentrivana)

    By passing a new option to the FastAPI and Starlette integrations, you're now able to configure what
    status codes should be sent as events to Sentry. Here's how it works:

    ```python
    from sentry_sdk.integrations.starlette import StarletteIntegration
    from sentry_sdk.integrations.fastapi import FastApiIntegration

    sentry_sdk.init(

...

  integrations=[
      StarletteIntegration(
          failed_request_status_codes=[403, range(500, 599)],
      ),
      FastApiIntegration(
          failed_request_status_codes=[403, range(500, 599)],
      ),
  ]

)

`failed_request_status_codes` expects a list of integers or containers (objects that allow membership checks via `in`)
of integers. Examples of valid `failed_request_status_codes`:

- `[500]` will only send events on HTTP 500.
- `[400, range(500, 599)]` will send events on HTTP 400 as well as the 500-599 range.
- `[500, 503]` will send events on HTTP 500 and 503.

The default is `[range(500, 599)]`.

See the [FastAPI](https://docs.sentry.io/platforms/python/integrations/fastapi/) and [Starlette](https://docs.sentry.io/platforms/python/integrations/starlette/) integration docs for more details.

- Support multiple keys with `cache_prefixes` (#​3136) by @​sentrivana
- Support integer Redis keys (#​3132) by @​sentrivana
- Update SDK version in CONTRIBUTING.md (#​3129) by @​sentrivana
- Bump actions/checkout from 4.1.4 to 4.1.5 (#​3067) by @​dependabot

v2.4.0

Compare Source

Various fixes & improvements

• Celery: Made cache.key span data field a list (#​3110) by @​antonpirker
• Celery Beat: Refactor the Celery Beat integration (#​3105) by @​antonpirker
• GRPC: Add None check for grpc.aio interceptor (#​3109) by @​ordinary-jamie
• Docs: Remove last_event_id from migration guide (#​3126) by @​szokeasaurusrex
• fix(django): Proper transaction names for i18n routes (#​3104) by @​sentrivana
• fix(scope): Copy _last_event_id in Scope.__copy__ (#​3123) by @​szokeasaurusrex
• fix(tests): Adapt to new Anthropic version (#​3119) by @​sentrivana
• build(deps): bump checkouts/data-schemas from 4381a97 to 59f9683 (#​3066) by @​dependabot

v2.3.1

Compare Source

Various fixes & improvements

• Handle also byte arras as strings in Redis caches (#​3101) by @​antonpirker
• Do not crash exceptiongroup (by patching excepthook and keeping the name of the function) (#​3099) by @​antonpirker

v2.3.0

Compare Source

Various fixes & improvements

• NEW: Redis integration supports now Sentry Caches module. See https://docs.sentry.io/product/performance/caches/ (#​3073) by @​antonpirker
• NEW: Django integration supports now Sentry Caches module. See https://docs.sentry.io/product/performance/caches/ (#​3009) by @​antonpirker
• Fix cohere testsuite for new release of cohere (#​3098) by @​antonpirker
• Fix ClickHouse integration where _sentry_span might be missing (#​3096) by @​sentrivana

v2.2.1

Compare Source

Various fixes & improvements

• Add conditional check for delivery_info's existence (#​3083) by @​cmanallen
• Updated deps for latest langchain version (#​3092) by @​antonpirker
• Fixed grpcio extras to work as described in the docs (#​3081) by @​antonpirker
• Use pythons venv instead of virtualenv to create virtual envs (#​3077) by @​antonpirker
• Celery: Add comment about kwargs_headers (#​3079) by @​szokeasaurusrex
• Celery: Queues module producer implementation (#​3079) by @​szokeasaurusrex
• Fix N803 flake8 failures (#​3082) by @​szokeasaurusrex

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate[bot]]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (==2.8.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.