Skip to content

bugsink

v2.2.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 13d Error & Performance Tracking
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Affected surfaces

auth rbac

ReleasePort's take

Light signal
editorial:auto 13d

Bugsink 2.2.0 scopes issue actions, event lookups, sourcemaps, and minidump metadata to authorized projects. This prevents unintended cross-project data access in multi-tenant deployments.

Why it matters: All pre-2.2.0 deployments lack proper authorization scoping for issue actions and event lookups. Upgrade to 2.2.0 immediately to prevent cross-project data leakage in multi-tenant environments.

Summary

AI summary

Scope issue actions, event lookups, sourcemaps, and minidump metadata to the authorized project to prevent cross‑project data access.

Changes in this release

Security Medium

Fix: scope issue actions and event lookups to the authorized project/issue.

Fix: scope issue actions and event lookups to the authorized project/issue.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Security Medium

Fix: scope sourcemap and minidump debug-file metadata to projects.

Fix: scope sourcemap and minidump debug-file metadata to projects.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

Generate an `event_id` on `/store/` when the SDK does not send one, see #383.

Generate an `event_id` on `/store/` when the SDK does not send one, see #383.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Feature Medium

Include ingest-dir cleanup in the `vacuum` command and warn about stale ingest-dir files, see 772fb1a9bff6 and 1ee34c574b7d.

Include ingest-dir cleanup in the `vacuum` command and warn about stale ingest-dir files, see 772fb1a9bff6 and 1ee34c574b7d.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Feature Medium

Broaden phonehome triggers and avoid unnecessary queueing, see 2f76eacfbf68.

Broaden phonehome triggers and avoid unnecessary queueing, see 2f76eacfbf68.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Feature Medium

Fix direct minidump endpoint calls, see 5324d802cc50.

Fix direct minidump endpoint calls, see 5324d802cc50.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Deprecation Medium

Sourcemap uploads should include a meaningful project slug. Existing unscoped sourcemaps keep working, but installations that prefer to remove that fallback can run `delete_legacy_sourcemaps` and re-upload sourcemaps with project slugs.

Sourcemap uploads should include a meaningful project slug. Existing unscoped sourcemaps keep working, but installations that prefer to remove that fallback can run `delete_legacy_sourcemaps` and re-upload sourcemaps with project slugs.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Deprecation Medium

Sourcemap uploads should include a meaningful project slug; legacy unscoped sourcemaps may be removed via delete_legacy_sourcemaps.

Sourcemap uploads should include a meaningful project slug; legacy unscoped sourcemaps may be removed via delete_legacy_sourcemaps.

Source: granite4.1:30b@2026-05-21-audit

Confidence: low

 —
Bugfix Medium

Fix health-check `ALLOWED_HOSTS`-ignore, see #140, #397.

Fix health-check `ALLOWED_HOSTS`-ignore, see #140, #397.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Refresh issue title fields on every event digest, see #378.

Refresh issue title fields on every event digest, see #378.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Add more verbose output to file vacuuming, see #372.

Add more verbose output to file vacuuming, see #372.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Fix API catch-all logging for non-JSON bodies, see d13e5eff132b.

Fix API catch-all logging for non-JSON bodies, see d13e5eff132b.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Ensure `release` is a string before ingesting, see 374914c96f62.

Ensure `release` is a string before ingesting, see 374914c96f62.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Full changelog

2.2.0 (21 May 2026)

Security

Fix: scope issue actions and event lookups to the authorized project/issue.

A project member who knew UUIDs from another project could use some issue-list
bulk actions and issue event views through a project or issue they were allowed
to access. These views now require the selected issues/events to belong to the
authorized parent. See:

https://github.com/bugsink/bugsink/security/advisories/GHSA-g5vc-q7qc-v939
https://github.com/bugsink/bugsink/security/advisories/GHSA-vx2f-6m6h-9frf

Fix: scope sourcemap and minidump debug-file metadata to projects.

Sourcemap and debug-file IDs are client-provided and were previously resolved
globally. That could let events in one project use uploaded debug metadata from
another project. Newly uploaded files now store project information and lookup
prefers project-scoped metadata. Already-uploaded legacy sourcemaps/debug files
keep working through a fallback. See:

https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8

Smaller fixes

  • Fix health-check ALLOWED_HOSTS-ignore, see #140, #397
  • Generate an event_id on /store/ when the SDK does not send one, see #383.
  • Refresh issue title fields on every event digest, see #378.
  • Include ingest-dir cleanup in the vacuum command and warn about stale ingest-dir files, see 772fb1a9bff6 and
    1ee34c574b7d.
  • Add more verbose output to file vacuuming, see #372.
  • Broaden phonehome triggers and avoid unnecessary queueing, see 2f76eacfbf68.
  • Fix API catch-all logging for non-JSON bodies, see d13e5eff132b.
  • Ensure release is a string before ingesting, see 374914c96f62.
  • Fix direct minidump endpoint calls, see 5324d802cc50.

Upgrading

Sourcemap uploads should include a meaningful project slug. Existing unscoped
sourcemaps keep working, but installations that prefer to remove that fallback
can run delete_legacy_sourcemaps and re-upload sourcemaps with project slugs.

Security Fixes

  • GHSA-g5vc-q7qc-v939 — scopes issue actions and event lookups to the authorized project.
  • GHSA-vx2f-6m6h-9frf — scopes sourcemap and minidump debug‑file metadata to projects, preventing cross‑project data access.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track bugsink

Get notified when new releases ship.

Sign up free

About bugsink

Self-hosted Error Tracking

All releases →

Related context

Beta — feedback welcome: [email protected]