Skip to content

sentry-cli

v2.58.6 Security

This release includes 6 security fixes for security teams reviewing exposed deployments.

Published 13d Error & Performance Tracking
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 6 known CVEs

Topics

cli crash-reporting rust sentry sentry-cli tag-production
+1 more
team-web-backend

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Light signal
editorial:auto 13d

sentry-cli 2.58.6 disables Xcode Info.plist preprocessing by default to prevent insecure compiler settings from being passed to builds. The release also hardens credential handling with restrictive file permissions, proper TLS verification, and stops transmitting environment variables in bash-hook events.

Why it matters: Operators using Xcode with sentry-cli must validate builds after upgrading. Review credential file permissions, TLS verification settings, and bash-hook configuration; environment variables will no longer be transmitted.

Summary

AI summary

Disable Xcode Info.plist preprocessing by default to prevent insecure compiler settings from being passed.

Changes in this release

Security Medium

Ensure restrictive file permissions maintained when sentry-cli login updates config.

Ensure restrictive file permissions maintained when sentry-cli login updates config.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Security Medium

Stop sending environment variables in sentry-cli bash-hook events.

Stop sending environment variables in sentry-cli bash-hook events.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Security Medium

Shell-escape bash-hook arguments including paths, tags, release names, CLI path.

Shell-escape bash-hook arguments including paths, tags, release names, CLI path.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Security Medium

Verify downloaded binary checksum before replacing current executable in update.

Verify downloaded binary checksum before replacing current executable in update.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Breaking Medium

Disable Xcode Info.plist preprocessing by default in release operations.

Disable Xcode Info.plist preprocessing by default in release operations.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Disable TLS verification only when http.verify_ssl explicitly set to false.

Disable TLS verification only when http.verify_ssl explicitly set to false.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Full changelog

Security Fixes

  • Behavior-breaking: Disable Xcode Info.plist preprocessing by default to avoid passing project-controlled compiler settings to cc during release auto-discovery. This affects sentry-cli releases propose-version, sentry-cli send-event and sentry-cli bash-hook --send-event release inference, and sentry-cli react-native xcode auto-release detection. Use --allow-xcode-infoplist-preprocessing only for trusted projects that require preprocessing.
  • Ensure restrictive file permissions maintained when sentry-cli login updates existing config files.
  • Disable TLS verification only when http.verify_ssl is set to false, case-insensitively.
  • Shell-escape generated bash-hook arguments, including paths, tags, release names, and the CLI path.
  • Stop sending environment variables in sentry-cli bash-hook events.
  • Verify the downloaded binary checksum before replacing the current executable in sentry-cli update.

Breaking Changes

  • Disabled Xcode `Info.plist` preprocessing by default; use `--allow-xcode-infoplist-preprocessing` for trusted projects.

Security Fixes

  • Prevented project-controlled compiler settings from being passed to `cc` via Info.plist preprocessing.
  • Enforced restrictive file permissions on config updates from `sentry-cli login`.
  • Restricted TLS verification disablement to explicit case‑insensitive `http.verify_ssl=false` configuration.
  • Shell‑escaped all arguments in generated `bash-hook` scripts.
  • Stopped sending environment variables with `bash-hook` events.
  • Verified checksum of downloaded binary before replacing executable in `sentry-cli update`.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track sentry-cli

Get notified when new releases ship.

Sign up free

About sentry-cli

A command line utility to work with Sentry.

All releases →

Related context

Earlier breaking changes

  • v3.4.3 Disables Xcode Info.plist preprocessing by default for certain sentry-cli commands.
  • v3.4.3 Disables Xcode Info.plist preprocessing by default to prevent compiler settings injection.

Beta — feedback welcome: [email protected]