Update dependency @sentry/browser to v7 [SECURITY]#5451
Update dependency @sentry/browser to v7 [SECURITY]#5451renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
|
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
3 times, most recently
from
91ff8cd to
387b76b
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
387b76b to
ea989dd
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
6 times, most recently
from
aaa9844 to
c03ddec
Compare
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| "@material-ui/core": "^4.2.1", | ||
| "@mitodl/iso-3166-2": "^1.0.1", | ||
| "@sentry/browser": "^6.4.1", | ||
| "@sentry/browser": "^7.0.0", |
There was a problem hiding this comment.
Bug: Upgrading @sentry/browser to v7.0.0 will ship untranspiled ES6 code to IE11 users because the Babel loader configuration does not process the @sentry/browser package.
Severity: CRITICAL
Suggested Fix
Update the babelSharedLoader configuration in your webpack settings to include the path to the @sentry/browser package. This will ensure its code is transpiled to ES5, making it compatible with older browsers like IE11. For example, add path.resolve(__dirname, "node_modules/@sentry/browser") to the include array.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L13
Potential issue: Upgrading `@sentry/browser` to v7.0.0 introduces ES6 code. The
project's webpack configuration for the Babel loader explicitly specifies an `include`
path that only transpiles application code and the `@material-ui` library, but not other
`node_modules` like `@sentry/browser`. The application actively supports Internet
Explorer 11, which does not understand ES6 syntax. As a result, any IE11 user loading
the site will encounter a JavaScript syntax error when the untranspiled Sentry package
is loaded. This will prevent Sentry from initializing and is likely to break other
critical page functionality, preventing the page from loading correctly for those users.
Did we get this right? 👍 / 👎 to inform future reviews.
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
4 times, most recently
from
a4fd6cc to
e05c6c3
Compare
| "@material-ui/core": "^4.2.1", | ||
| "@mitodl/iso-3166-2": "^1.0.1", | ||
| "@sentry/browser": "^6.4.1", | ||
| "@sentry/browser": "^7.0.0", |
There was a problem hiding this comment.
Bug: Upgrading @sentry/browser to v7 will break the application for IE11 users because its ES6 code is not being transpiled to ES5 by the current webpack configuration.
Severity: HIGH
Suggested Fix
Update the webpack configuration in webpack.config.shared.js to include @sentry/browser in the babelSharedLoader's include array. This will ensure the Sentry SDK is transpiled to ES5, maintaining compatibility with older browsers like IE11.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L13
Potential issue: The upgrade to `@sentry/browser` v7 introduces untranspiled ES6 code.
The project's webpack configuration in `webpack.config.shared.js` does not include
`@sentry/browser` in its Babel transpilation process. The application has historically
supported Internet Explorer 11, which does not support modern ES6 syntax. Because the
Sentry client bundle is loaded early in the page's `<head>`, users on IE11 will
encounter JavaScript syntax errors during initialization, causing the application to
fail to load.
4fb9a0f to
d397cba
Compare
| "@material-ui/core": "^4.2.1", | ||
| "@mitodl/iso-3166-2": "^1.0.1", | ||
| "@sentry/browser": "^6.4.1", | ||
| "@sentry/browser": "^7.0.0", |
There was a problem hiding this comment.
Bug: The yarn.lock file was not updated after changing the @sentry/browser version in package.json. This results in the old, vulnerable version being installed.
Severity: CRITICAL
Suggested Fix
Regenerate the yarn.lock file to reflect the version change in package.json. This can be done by running yarn install or yarn upgrade @sentry/browser, which will update the lockfile to resolve to a secure version of @sentry/browser.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L13
Potential issue: The pull request updates `package.json` to use `@sentry/browser:
^7.0.0` to patch a security vulnerability (GHSA-593m-55hh-j8gv). However, the
`yarn.lock` file was not regenerated. As a result, `yarn install` will continue to
install the old, vulnerable version (`6.7.1`) specified in the lockfile, instead of the
intended secure version. This leaves the application exposed to the Prototype Pollution
gadget attack that the upgrade was meant to fix.
29baf1a to
a7a1655
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
a7a1655 to
4c8686f
Compare
| @@ -10,7 +10,7 @@ | |||
| "@fancyapps/fancybox": "^3.5.7", | |||
| "@material-ui/core": "^4.2.1", | |||
| "@mitodl/iso-3166-2": "^1.0.1", | |||
There was a problem hiding this comment.
Bug: The Sentry v7 upgrade introduces ES6 syntax that is not being transpiled by Babel, which will break the application on older browsers like IE11.
Severity: HIGH
Suggested Fix
Update the include array for the babelSharedLoader in webpack.config.shared.js to also process the @sentry/browser package. This will ensure its ES6 syntax is correctly transpiled to ES5 for compatibility with older browsers.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L12
Potential issue: The upgrade to `@sentry/browser` v7 introduces untranspiled ES6 syntax
into the production bundle. The project's Babel configuration in
`webpack.config.shared.js` explicitly includes only `static/js` and `@material-ui` for
transpilation, excluding all other `node_modules` packages. Because `@sentry/browser` is
not included, its ES6 code will not be converted to ES5. This will cause JavaScript
parsing and execution errors for users on older browsers that do not support ES6, such
as Internet Explorer 11, potentially breaking the application for them.
c2679c3 to
b5ec281
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
2 times, most recently
from
2c8bd80 to
6c9c26b
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
6 times, most recently
from
9cb9134 to
e3f0dc4
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
5 times, most recently
from
0de7713 to
82bdab3
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
82bdab3 to
251f2c9
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
251f2c9 to
7d4a602
Compare
This PR contains the following updates:
^6.4.1→^7.0.0GitHub Vulnerability Alerts
GHSA-593m-55hh-j8gv
Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
Note
This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version.
Also, the fix was backported to SDK v7 in 7.119.1.
References
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NSentry SDK Prototype Pollution gadget in JavaScript SDKs
GHSA-593m-55hh-j8gv
More information
Details
Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version.
Also, the fix was backported to SDK v7 in 7.119.1.
References
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
getsentry/sentry-javascript (@sentry/browser)
v7.119.1Compare Source
Work in this release contributed by @legobeat. Thank you for your contribution!
v7.119.0Compare Source
Bundle size 📦
v7.118.0Compare Source
window.Sentry(#12579)Bundle size 📦
v7.117.0Compare Source
v7tag to@sentry/replay(#12304)v7.116.0Compare Source
This release publishes a new AWS Lambda layer under the name
SentryNodeServerlessSDKv7that users still running v7 canuse instead of pinning themselves to
SentryNodeServerlessSDK:235.Bundle size 📦
v7.115.0Compare Source
start()(#12003)lastEventIddeprecation warnings (#12042)Bundle size 📦
v7.114.0Compare Source
Important Changes
This release fixes a bug that caused the cumulative layout shift (CLS) web vital not to be reported in a majority of the
cases where it should have been reported. With this change, the CLS web vital should now always be reported for
pageloads with layout shift. If a pageload did not have layout shift, no CLS web vital should be reported.
Please note that upgrading the SDK to this version may cause data in your dashboards to drastically change.
Other Changes
tunnelsupport to multiplexed transport (#11851)HTTP_REQUEST_METHODattribute (#11929)v7.113.0Compare Source
Important Changes
This release adds support for Node 22! 🎉
It also adds prebuilt-binaries for Node 22 to
@sentry/profiling-node.Other Changes
v7.112.2Compare Source
browserTracingIntegration(#11765)v7.112.1Compare Source
v7.112.0Compare Source
Important Changes
Instead of installing
@sentry/integrations, you can now import the pluggable integrations directly from your SDKpackage:
Note that only the functional integrations (e.g.
xxxIntegration()) are re-exported.Other Changes
Bundle size 📦
v7.111.0Compare Source
server.addressto browserhttp.clientspans (#11663)browserTracingIntegration(#11647)Bundle size 📦
v7.110.1Compare Source
tunnelRoutematching logic for hybrid cloud (#11577)Bundle size 📦
v7.110.0Compare Source
Important Changes
You can now use a
interactionsSampleRateto control the sample rate of INP spans.interactionsSampleRateis appliedon top of the global
tracesSampleRate. Therefore ifinteractionsSampleRateis0.5andtracesSampleRateis0.1,then the actual sample rate for interactions is
0.05.This release deprecates the
Hubclass, as well as theaddRequestDataToTransactionmethod. ThetrpcMiddlewaremethod is no longer on the
Handlersexport, but instead is a standalone export.Please see the detailed Migration docs on how to migrate to the new APIs.
trpcMiddleware(#11389)Hubclass (#11528)Hubinterface (#11530)addRequestDataToTransaction(#11368)Other Changes
OPTIONSandHEADrequest. (#11485)statsdtometric_bucket(#11505)Bundle size 📦
v7.109.0Compare Source
This release deprecates some exports from the
@sentry/replaypackage. These exports have been moved to the browser SDK(or related framework SDKs like
@sentry/react).rrwebto 2.12.0 (#11317)@sentry/replayexports (#11242)Work in this release contributed by @soerface. Thank you for your contribution!
Bundle size 📦
v7.108.0Compare Source
This release fixes issues with Time to First Byte (TTFB) calculation in the SDK that was introduced with
7.95.0. Italso fixes some bugs with Interaction to First Paint (INP) instrumentation. This may impact your Sentry Performance
Score calculation.
ResizeObserverandgoogletagdefault filters (#11210)cron(#11225)sampledtype onTransaction(#11146)Work in this release contributed by @quisido and @joshkel. Thank you for your contributions!
Bundle size 📦
v7.107.0Compare Source
This release fixes issues with INP instrumentation with the Next.js SDK and adds support for the
enableInpoption inthe deprecated
BrowserTracingintegration for backwards compatibility.handledvalue in ErrorBoundary depending on fallback [v7] (#11037)Bundle size 📦
| Path
Configuration
📅 Schedule: (in timezone US/Eastern)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.