Security Fixes
- Behavior-breaking: Disable Xcode
Info.plistpreprocessing by default to avoid passing project-controlled compiler settings toccduring release auto-discovery. This affectssentry-cli releases propose-version,sentry-cli send-eventandsentry-cli bash-hook --send-eventrelease inference, andsentry-cli react-native xcodeauto-release detection. Use--allow-xcode-infoplist-preprocessingonly for trusted projects that require preprocessing. - Ensure restrictive file permissions maintained when
sentry-cli loginupdates existing config files. - Disable TLS verification only when
http.verify_sslis set tofalse, case-insensitively. - Shell-escape generated
bash-hookarguments, including paths, tags, release names, and the CLI path. - Stop sending environment variables in
sentry-cli bash-hookevents. - Verify the downloaded binary checksum before replacing the current executable in
sentry-cli update.
Performance
- (snapshots) Skip uploading images that already exist in objectstore by batch-checking with HEAD requests first (#3305)
Fixes
- (snapshots) Reject snapshot uploads that have a PR number but no base SHA, since comparisons cannot work without a base reference (#3300)