bugsink

v2.4.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 16d Error & Performance Tracking

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal

editorial:auto 11d

ReleasePort Layer 1 2.4.0 now refuses to start when the PID_FILE directory is not owned by the process, and it adds outbound‑webhook protection against DNS rebinding bypasses.

Why it matters: If the PID_FILE path isn’t owned by the running user the service aborts; this change blocks a critical DNS rebinding vulnerability (severity 95).

Summary

AI summary

Fail to start if PID_FILE is not owned by the process, fixing DNS rebinding bypasses.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevents DNS rebinding bypasses in outbound webhook protection. Prevents DNS rebinding bypasses in outbound webhook protection. Source: llm_adapter@2026-07-15 Confidence: high	—
Breaking	High	Fails to start if PID_FILE directory not owned by process. Fails to start if PID_FILE directory not owned by process. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds compact 24h event-volume sparklines to project and issue lists. Adds compact 24h event-volume sparklines to project and issue lists. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	Medium	Allows manually reopening resolved issues. Allows manually reopening resolved issues. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Reduces Docker image size. Reduces Docker image size. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Improves handling of invalid payloads in envelope and deprecated `/store/` ingest paths. Improves handling of invalid payloads in envelope and deprecated `/store/` ingest paths. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Fixes AuthToken description edits applying to the wrong token. Fixes AuthToken description edits applying to the wrong token. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Low	Uses the ready endpoint in the sample Compose healthcheck. Uses the ready endpoint in the sample Compose healthcheck. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

2.4.0 (10 July 2026)

Backwards incompatible changes

Fail to start when PID_FILE is configured to be in a directory not owned by the process running gunicorn/snappea
(typically: the bugsink user). The reason for this is: extra defense in depth, as per #174.

Ensure that PID_FILE is either None (recommended in systemd setups, i.e. recommended in the recommended case) or, if
you must, in file in a directory "one level deep" (e.g. /tmp/snappea/snappea.pid or {base_path}/snappea/snappea.pid)

Otherwise you'll get a B108SecurityError ("Target path owned by uid other than me: ...")

See #195, #196

Security

Fix: prevent DNS rebinding bypasses in outbound webhook protection.

A project admin who controlled webhook DNS responses could make the policy check see an allowed public IP while the
actual HTTP request connected to a blocked internal destination. Bugsink now pins each webhook send to the validated DNS
result while preserving normal Host/SNI behavior. See:

https://github.com/bugsink/bugsink/security/advisories/GHSA-w589-2ffr-2prv

Sparklines / Trends

Project and issue lists now show compact 24h event-volume trends. Sparkline bucket boundaries respect the installation
timezone, and y-axis labels now use nicer count-oriented steps with a floor of 10 for low-volume charts. See #444,
#445 and #447.

Issue resolution

Resolved issues can be reopened manually. The Resolve controls also support a plain "Resolve" flow and resolve-by-current
release when observations already exist. See #431 and #436.

Smaller fixes

Fix AuthToken description edits applying to the wrong token, see #424.
Use the ready endpoint in the sample Compose healthcheck, see #426.
Reduce Docker image size, see #430.
Improve invalid payload handling in envelope and deprecated /store/ ingest paths, see #435.

Breaking Changes

Fail to start when `PID_FILE` is configured in a directory not owned by the running process (bugsink/gunicorn/snappea). Must set `PID_FILE` to None or use a path like `/tmp/snappea/snappea.pid` or `{base_path}/snappea/snappea.pid`.

Security Fixes

GHSA-w589-2ffr-2prv — Prevent DNS rebinding bypass in outbound webhook protection by pinning each webhook send to the validated DNS result while preserving Host/SNI behavior.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track bugsink

Get notified when new releases ship.

About bugsink

Self-hosted Error Tracking

All releases →