This release includes 1 security fix for security teams reviewing exposed deployments.
ReleasePort's take
Light signalReleasePort Layer 1 v2.2.2 caps tags per event at 100 and marks project slugs read‑only in the UI.
Why it matters: Security relevance: limiting tags to 100 mitigates potential abuse of excessive metadata (severity 70).
Summary
AI summaryFix: caps the number of tags stored per event at 100 to prevent long write transactions.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Caps number of tags per event to 100. Caps number of tags per event to 100. Source: llm_adapter@2026-06-04 Confidence: high |
— |
| Bugfix | Low |
Displays project slugs as read-only on project settings pages. Displays project slugs as read-only on project settings pages. Source: llm_adapter@2026-06-04 Confidence: high |
— |
Full changelog
2.2.2 (4 June 2026)
Security
Fix: cap the number of tags stored per event.
Events with very many tags could keep the single write transaction busy for longer than intended during digestion.
Bugsink now stores at most MAX_EVENT_TAGS tags per event, defaulting to 100.
https://github.com/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj
Smaller fixes
- Show project slugs as read-only on project settings pages, see #402.
Security Fixes
- GHSA-5x67-j5xg-c5gj — caps event tag count to 100 (default) to avoid prolonged write transactions
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v2.4.0 Fails to start if PID_FILE directory not owned by process.
Beta — feedback welcome: [email protected]