Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: getsentry/sentry-cli
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: c6a13b3
Choose a base ref
...
head repository: getsentry/sentry-cli
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 26113d4
Choose a head ref
  • 11 commits
  • 23 files changed
  • 6 contributors

Commits on Jun 16, 2026

  1. Merge branch 'release/3.5.1'

    @sentry-release-bot
    sentry-release-bot[bot] committed Jun 16, 2026
    Configuration menu
    Copy the full SHA
    15a1d3a View commit details
    Browse the repository at this point in the history

  2. build(npm): 🤖 Bump optional dependencies to 3.5.1

    @sentry-release-bot
    sentry-release-bot[bot] committed Jun 16, 2026
    Configuration menu
    Copy the full SHA
    7ca8ea2 View commit details
    Browse the repository at this point in the history

Commits on Jun 17, 2026

  1. chore(deps-dev): bump tar from 7.5.11 to 7.5.16 (#3335) 

    Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-tar/commit/cf213384ac558b539c07c830ed7cca5ffc9e8550"><code>cf21338</code></a>
7.5.16</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/21a822027658c8063542be330530bbecdf0dbbfe"><code>21a8220</code></a>
do not apply PAX header fields to meta entries</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/52632cf38fdbdbbc7ab86184d68a85b11fdb0970"><code>52632cf</code></a>
update project deps</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/302f51ff3f8eefeccc06be4caf7d0de9b7c321d7"><code>302f51f</code></a>
fix inconsequential typo in PENDINGLINKS symbol name</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/55dbb99b27640bb12b2ac059b26883c23523b3e3"><code>55dbb99</code></a>
remove some uses of mutate-fs</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/87cc309f13c21d598b0b833235d387a252455058"><code>87cc309</code></a>
7.5.15</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/7aef486f0d21c10fd7790b16b1b28f04648cf334"><code>7aef486</code></a>
fix: regression in pending links detection</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/6244eb33846bbd407443f5d0e339bd8c91663cd6"><code>6244eb3</code></a>
7.5.14</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/9704d8c6f639573775133cbbd541aba83cb46c9c"><code>9704d8c</code></a>
stricter protection against hardlinks preempting their targets</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/700734f9aeb113bcc5f1400d81b8be7d499e54a2"><code>700734f</code></a>
update workflows and deps</li>
<li>Additional commits viewable in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.11&new-version=7.5.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/getsentry/sentry-cli/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Jun 17, 2026
    Configuration menu
    Copy the full SHA
    d9766db View commit details
    Browse the repository at this point in the history

Commits on Jun 22, 2026

  1. feat(snapshots): Compress preprod snapshot manifest with zstd (#3336) 

    ## Summary

The preprod snapshot manifest sent by `create_preprod_snapshot` can be
large. This change compresses the manifest JSON body with zstd before
uploading, reducing the number of bytes transferred over the wire.

A new `with_zstd_json_body` request builder serializes the payload to
JSON, compresses it with `zstd::encode_all`, and sets `Content-Type:
application/json` alongside `Content-Encoding: zstd` (the content type
describes the decoded payload; the encoding describes the wire
transform).

## Changes

- Add `zstd = "0.13.3"` dependency.
- Add `ApiRequest::with_zstd_json_body` helper.
- Route `create_preprod_snapshot` through the zstd-compressed body path.

## Notes

- Requires the receiving endpoint to decode `Content-Encoding: zstd` on
request bodies — backend support should be confirmed deployed before
this ships.
    @NicoHinderling
    NicoHinderling authored Jun 22, 2026
    Configuration menu
    Copy the full SHA
    13922fe View commit details
    Browse the repository at this point in the history

Commits on Jun 23, 2026

  1. chore(deps): bump undici from 6.24.0 to 6.27.0 (#3340) 

    Bumps [undici](https://github.com/nodejs/undici) from 6.24.0 to 6.27.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nodejs/undici/releases">undici's
releases</a>.</em></p>
<blockquote>
<h2>v6.27.0</h2>
<h1>⚠️ Security Release</h1>
<p>This release line addresses <strong>4 security
advisories</strong>.</p>
<blockquote>
<p><strong>Action required:</strong> Upgrade to <strong>undici
6.27.0</strong> or later.</p>
<pre lang="sh"><code>npm install undici@^6.27.0
</code></pre>
</blockquote>
<blockquote>
<p><strong>Note on patched version:</strong> the v6 fixes shipped in
<strong>v6.27.0</strong>, not <code>6.26.0</code>
— <code>v6.26.0</code> contains only the chunked-EOF fix (<a
href="https://redirect.github.com/nodejs/undici/issues/5308">#5308</a>)
and the version bump, none
of the security fixes below.</p>
</blockquote>
<p>The v6 line is <strong>not</strong> affected by the SOCKS5 advisories
(GHSA-vmh5-mc38-953g,
GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6),
or the
8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).</p>
<h2>Summary</h2>
<table>
<thead>
<tr>
<th>Advisory</th>
<th>CVE</th>
<th>Severity (CVSS)</th>
<th>Fixed in</th>
<th>Fix commit</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q">GHSA-vxpw-j846-p89q</a></td>
<td>CVE-2026-12151</td>
<td>High (7.5)</td>
<td>6.27.0</td>
<td><a
href="https://github.com/nodejs/undici/commit/b7f252e7"><code>b7f252e7</code></a></td>
</tr>
<tr>
<td><a
href="https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv">GHSA-p88m-4jfj-68fv</a></td>
<td>CVE-2026-9679</td>
<td>Moderate (5.9)</td>
<td>6.27.0</td>
<td><a
href="https://github.com/nodejs/undici/commit/25efa447"><code>25efa447</code></a></td>
</tr>
<tr>
<td><a
href="https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m">GHSA-g8m3-5g58-fq7m</a></td>
<td>CVE-2026-11525</td>
<td>Low (3.7)</td>
<td>6.27.0</td>
<td><a
href="https://github.com/nodejs/undici/commit/25efa447"><code>25efa447</code></a></td>
</tr>
<tr>
<td><a
href="https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52">GHSA-35p6-xmwp-9g52</a></td>
<td>CVE-2026-6733</td>
<td>Low (3.7)</td>
<td>6.27.0</td>
<td><a
href="https://github.com/nodejs/undici/commit/f4c31d60"><code>f4c31d60</code></a></td>
</tr>
</tbody>
</table>
<hr />
<h2>High severity</h2>
<h3>WebSocket DoS via fragment count bypass — CVE-2026-12151</h3>
<p><strong><a
href="https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q">GHSA-vxpw-j846-p89q</a></strong>
· CWE-400, CWE-770
<strong>Fix:</strong> <a
href="https://github.com/nodejs/undici/commit/b7f252e7"><code>b7f252e7</code></a>
<em>Backport WebSocket maxPayloadSize fixes</em> (<a
href="https://redirect.github.com/nodejs/undici/pull/5423">#5423</a>,
backported to v6 in <a
href="https://redirect.github.com/nodejs/undici/pull/5428">#5428</a>)</p>
<p>A malicious WebSocket server can stream a large number of small or
empty
continuation frames. Undici enforced a limit on cumulative payload size
but did
not limit the <em>number</em> of fragments per message, leading to
unbounded memory
growth and denial of service. All releases from 6.17.0 onward are
affected.</p>
<ul>
<li><strong>Affected:</strong> applications using <code>new
WebSocket(...)</code> or <code>WebSocketStream</code>
against untrusted endpoints.</li>
<li><strong>Workaround:</strong> none — upgrade is required.</li>
</ul>
<hr />
<h2>Moderate severity</h2>
<h3>HTTP header injection via Set-Cookie percent-decoding —
CVE-2026-9679</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodejs/undici/commit/551138cbc1742c92242a68216167761075e8a82c"><code>551138c</code></a>
Bumped v6.27.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/5431">#5431</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/b7f252e7c0841418fb9d95cd297bdd9fad9d2a53"><code>b7f252e</code></a>
Backport WebSocket maxPayloadSize fixes to v7.x (<a
href="https://redirect.github.com/nodejs/undici/issues/5423">#5423</a>)
(<a
href="https://redirect.github.com/nodejs/undici/issues/5428">#5428</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/25efa447997f74d5881edd144525c3fd7db945a4"><code>25efa44</code></a>
fix(cookies): preserve values and parse SameSite strictly</li>
<li><a
href="https://github.com/nodejs/undici/commit/f4c31d60c42d0385bca6ad602c112706b0695212"><code>f4c31d6</code></a>
fix: guard idle socket validation to skip fresh sockets (<a
href="https://redirect.github.com/nodejs/undici/issues/5400">#5400</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/768beacd331786c6a1ca61dd81938fca041a45b5"><code>768beac</code></a>
Bumped v6.26.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/5323">#5323</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/7917b254484132f848fb785afbc398b1cfba389f"><code>7917b25</code></a>
fix: validate EOF for chunked h1 responses (<a
href="https://redirect.github.com/nodejs/undici/issues/5308">#5308</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/3420499cad88e72e04972b7bb28dd9f2ec2638ac"><code>3420499</code></a>
Bumped v6.25.0 (<a
href="https://redirect.github.com/nodejs/undici/issues/5029">#5029</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/d7a1e55fbe9607e8b56a10b4be129ca63d16014b"><code>d7a1e55</code></a>
feat: add configurable maxPayloadSize for WebSocket (<a
href="https://redirect.github.com/nodejs/undici/issues/4955">#4955</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/a9d1848fa18d351813e9563bb7653acf1e3c60ad"><code>a9d1848</code></a>
Do not mark v6.x releases as latest</li>
<li><a
href="https://github.com/nodejs/undici/commit/01265866974369f75f939109969097e45e72b1e1"><code>0126586</code></a>
Ignore local agent configuration files</li>
<li>Additional commits viewable in <a
href="https://github.com/nodejs/undici/compare/v6.24.0...v6.27.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=undici&package-manager=npm_and_yarn&previous-version=6.24.0&new-version=6.27.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/getsentry/sentry-cli/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Jun 23, 2026
    Configuration menu
    Copy the full SHA
    fddec6f View commit details
    Browse the repository at this point in the history

  2. build(rust): Update Rust toolchain to 1.96 (#3318) 

    Update Rust toolchain to 1.96 (1.96.0).

  **Changes:**
  - Update `rust-toolchain.toml` channel to `1.96`

**Release Notes:** https://github.com/rust-lang/rust/releases/tag/1.96.0

  ---
🤖 *This PR was created automatically by the Rust toolchain update bot.*

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
    @github-actions
    github-actions[bot] authored Jun 23, 2026
    Configuration menu
    Copy the full SHA
    7da59d6 View commit details
    Browse the repository at this point in the history

  3. fix(snapshots): Show clear error when project slug was renamed (#3341) 

    `snapshots upload` against a renamed project slug failed with `could not
parse JSON response: missing field 'objectstore'`. On a rename the API
returns a `302` whose body the snapshot calls deserialized as their
response type, bypassing `convert_rnf` — the helper every other
project-scoped endpoint uses to surface renames.

This routes both snapshot calls through `convert_rnf`, which now reads
the new slug from the top-level `slug` field the server actually sends
(it previously read a non-existent `detail.slug`, leaving the rename
message dead for all `ProjectNotFound` callers). Users now get the
existing clear `project was renamed to '<slug>'` error.

Scope is project renames only; org renames (404) and the same latent
failure on `events list` / `issues` commands are out of scope.

Fixes #3337
    @NicoHinderling
    NicoHinderling authored Jun 23, 2026
    Configuration menu
    Copy the full SHA
    c96e571 View commit details
    Browse the repository at this point in the history

Commits on Jun 25, 2026

  1. fix(vcs): Upgrade git2 to address RustSec advisories (#3345) 

    Upgrade git2 to 0.21.0 to pick up fixes for the open RustSec advisories
covering Remote::list() and blame APIs.

The code changes are because git2 has [changed several method signatures
to return
`Result`](https://github.com/rust-lang/git2-rs/blob/main/CHANGELOG.md#changed).

Closes #3338
Closes [CLI-334](https://linear.app/getsentry/issue/CLI-334)

Closes #3339
Closes [CLI-335](https://linear.app/getsentry/issue/CLI-335)
    @szokeasaurusrex
    szokeasaurusrex authored Jun 25, 2026
    Configuration menu
    Copy the full SHA
    134b728 View commit details
    Browse the repository at this point in the history

  2. feat(snapshots): Download via archive endpoint with build-and-poll (#… 

    …3344)
    @NicoHinderling
    NicoHinderling authored Jun 25, 2026
    Configuration menu
    Copy the full SHA
    8788954 View commit details
    Browse the repository at this point in the history

Commits on Jun 26, 2026

  1. fix(update): correct inverted version comparison in update nagger (#3347 

    )
    @syf2211
    syf2211 authored Jun 26, 2026
    Configuration menu
    Copy the full SHA
    ae25f73 View commit details
    Browse the repository at this point in the history

  2. release: 3.6.0

    @szokeasaurusrex
    szokeasaurusrex committed Jun 26, 2026
    Configuration menu
    Copy the full SHA
    26113d4 View commit details
    Browse the repository at this point in the history
Loading