sentry-sdk 2.73.0

Source: https://github.com/getsentry/sentry-python
Tag scanned: 2.73.0
Compared with: 2.72.0 (0 signals introduced since)
Files: 546 scanned, 44 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 33 info
Scan time: 22.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 32 of 32 warn and critical signals; 32 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 21:29

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line README.md:83:1

line length 515 characters (raw pass, confidence 0.50)

Sentry integrates with a ton of popular Python libraries and frameworks, including [FastAPI](https://docs.sentry.io/platforms/python/integrations/fastapi/), [Django](https://docs.sentry.io/platforms/python/integrations/django/), [Celery](https://docs.sentry.io/platforms/python/integrations/celery/), [OpenAI](https://do

info ~~warn~~ → info by review encoding-base64 sentry_sdk/consts.py:396:15

base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
    The AWS extended request ID as returned in the response headers.
    Example: "wzHcyEWfmOGDIE5QOhTAqFDoDWP3y8IUvpNINCwL9N4TEHbUw0/gZJ+VZTmCNCWR7fezEN3eCiQ="
    """
```
likely benign LLM, confidence 0.95 Docstring example of an AWS extended request ID.
Reasoning
The base64-like string is an example AWS request ID inside a docstring, not executable or hidden payload.
info ~~warn~~ → info by review frame-introspection sentry_sdk/tracing_utils.py:317:39

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    # Find the correct frame
    frame: "Union[FrameType, None]" = sys._getframe()
    while frame is not None:
        abs_path = _get_frame_module_abs_path(frame)
```
likely benign LLM, confidence 0.95 Sentry SDK walks the call stack to find the correct frame for source path lookup.
Reasoning
sys._getframe is used by the Sentry SDK to locate the calling frame for module path resolution, a standard diagnostic practice.
info ~~warn~~ → info by review frame-introspection sentry_sdk/utils.py:676:32

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    f: "Optional[FrameType]" = sys._getframe()
    while f is not None:
        if not should_hide_frame(f):
```
likely benign LLM, confidence 0.95 Stack walk to determine which frames to report, skipping hidden ones.
Reasoning
Frame walking to skip hidden frames when building stack traces is legitimate SDK behavior.
info ~~warn~~ → info by review decoder-decompress-payload tests/conftest.py:1807:34

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            elif content_encoding == "br":
                rdr = io.BytesIO(brotli.decompress(request.data))
                compressed = True
            else:
```
likely benign LLM, confidence 0.93 Test helper decompresses recorded request bodies for assertions.
Reasoning
Test fixture decompressing a brotli/gzip HTTP request body captured from the test transport; expected test infrastructure.
info ~~warn~~ → info by review decoder-decompress-payload tests/integrations/aws_lambda/utils.py:242:24

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            try:
                body = gzip.decompress(raw_body).decode("utf-8")
            except Exception:
                # If decompression fails, assume it's plain text
```
likely benign LLM, confidence 0.93 Test helper that decompresses gzip bodies with fallback to plain text.
Reasoning
Test utility gunzips a response body with a plaintext fallback; ordinary test parsing code.
info ~~warn~~ → info by review frame-introspection tests/integrations/django/test_basic.py:2534:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            """
            return inspect.currentframe()

    class GetFrame:
```
likely benign LLM, confidence 0.95 Test class returning the current frame to exercise frame logic.
Reasoning
Test helper returning inspect.currentframe() to verify frame handling in a lazy object wrapper; no malicious behavior.
info ~~warn~~ → info by review frame-introspection tests/integrations/django/test_basic.py:2546:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            """
            return inspect.currentframe()

    instance = SimpleLazyObjectWrapper(lambda: GetFrame())
```
likely benign LLM, confidence 0.95 Test lazy-object wrapper returning the current frame.
Reasoning
Same test helper pattern as the sibling finding; benign test scaffolding.
info ~~critical~~ → info by review dynamic-execution tests/integrations/gcp/test_gcp.py:122:13

`subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
            subprocess.check_call(
                "uv pip install -p {} ../*.tar.gz --target .".format(sys.executable),
                cwd=tmpdir,
```
likely benign LLM, confidence 0.85 Test installs a built package via uv with a shell command using a temp directory.
Reasoning
The shell command interpolates sys.executable and a tmpdir path inside a test that builds and installs a package; it is test tooling, though shell=True with formatted strings is poor practice and the command is not attacker-controlled.
info ~~critical~~ → info by review dynamic-execution tests/integrations/gcp/test_gcp.py:129:22

`os.popen` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
            stream = os.popen("python {}/main.py".format(tmpdir))
            stream_data = stream.read()
```
likely benign LLM, confidence 0.85 Test runs a generated main.py via os.popen in a temp directory.
Reasoning
os.popen formats only a local tmpdir path into a test command running a local main.py; benign test execution, flagged only due to non-literal command.
info ~~warn~~ → info by review encoding-base64 tests/integrations/google_genai/test_google_genai.py:3265:26

base64-like blob (104 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
            "inline_data": {
                "data": "iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAFUlEQVR42mP8z8BQz0AEYBxVSF+FABJADveWkH6oAAAAAElFTkSuQmCC",
                "mime_type": "image/png",
            }
```
likely benign LLM, confidence 0.95 Base64-encoded tiny PNG used as test image data.
Reasoning
A small PNG image encoded as base64 test fixture for inline_data; expected in multimodal API tests.
info ~~warn~~ → info by review encoding-base64 tests/integrations/langchain/test_langchain.py:5776:47

base64-like blob (96 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
            "image_url": {
                "url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
            },
        }
```
likely benign LLM, confidence 0.95 Base64 PNG data URL in a LangChain multimodal test.
Reasoning
A tiny PNG data URL used as a test image input; benign fixture.
info ~~warn~~ → info by review encoding-base64 tests/integrations/langchain/test_langchain.py:5784:25

base64-like blob (96 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
            "mime_type": "image/png",
            "content": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
        }
```
likely benign LLM, confidence 0.95 Base64 PNG content string in a LangChain test.
Reasoning
Same tiny PNG base64 fixture as the sibling finding; benign test data.
info ~~warn~~ → info by review encoding-base64 tests/integrations/pydantic_ai/test_pydantic_ai.py:4123:40

base64-like blob (56 bytes, compression ratio 1.20) (raw pass, confidence 0.60)
```
        pytest.param(
            "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciLz4=",
            {},
            BLOB_DATA_SUBSTITUTE,
```
likely benign LLM, confidence 0.95 Base64 SVG data URL used as a pydantic_ai test parameter.
Reasoning
A small SVG data URL test parameter; benign fixture for blob substitution tests.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:333:12

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        return get_frame(depth=depth - 1)
    return inspect.currentframe()
```
likely benign LLM, confidence 0.93 Test helper that returns a frame at a requested depth for profiler tests.
Reasoning
Profiler test helper returning inspect.currentframe() at a given depth to test frame capture; benign.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:338:16

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def inherited_instance_method(self):
        return inspect.currentframe()

    def inherited_instance_method_wrapped(self):
```
dismissed LLM, confidence 0.93 Test helper returning the current frame from an inherited instance method.
Reasoning
Test helper that returns inspect.currentframe() to verify the profiler's stack capture for inherited instance methods. Frame introspection is the subject under test, and the file is a test module.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:342:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        def wrapped():
            return inspect.currentframe()

        return wrapped
```
dismissed LLM, confidence 0.93 Nested test wrapper that returns the current frame.
Reasoning
Nested wrapper in a profiler test returning inspect.currentframe() so the test can check frame naming and depth. Legitimate test scaffolding.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:348:16

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def inherited_class_method(cls):
        return inspect.currentframe()

    @classmethod
```
dismissed LLM, confidence 0.93 Test classmethod returning the current frame.
Reasoning
Classmethod test helper returning the current frame, used to exercise profiler stack extraction for inherited class methods.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:353:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        def wrapped():
            return inspect.currentframe()

        return wrapped
```
dismissed LLM, confidence 0.93 Nested test wrapper returning the current frame.
Reasoning
Nested wrapper in the same profiler test family, returning the current frame to check captured frame information.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:359:16

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def inherited_static_method():
        return inspect.currentframe()
```
dismissed LLM, confidence 0.93 Test static method returning the current frame.
Reasoning
Static method test helper returning the current frame to validate profiler output for static methods.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:364:16

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def instance_method(self):
        return inspect.currentframe()

    def instance_method_wrapped(self):
```
dismissed LLM, confidence 0.93 Test instance method returning the current frame.
Reasoning
Instance method test helper returning the current frame, part of a matrix of method kinds the profiler test covers.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:368:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        def wrapped():
            return inspect.currentframe()

        return wrapped
```
dismissed LLM, confidence 0.93 Nested test wrapper returning the current frame.
Reasoning
Nested wrapper returning the current frame in the profiler method-kind test matrix.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:374:16

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def class_method(cls):
        return inspect.currentframe()

    @classmethod
```
dismissed LLM, confidence 0.93 Test classmethod returning the current frame.
Reasoning
Classmethod test helper returning the current frame for profiler coverage of class methods.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:379:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        def wrapped():
            return inspect.currentframe()

        return wrapped
```
dismissed LLM, confidence 0.93 Nested test wrapper returning the current frame.
Reasoning
Nested wrapper returning the current frame in the profiler test matrix.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:385:16

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def static_method():
        return inspect.currentframe()
```
dismissed LLM, confidence 0.93 Test static method returning the current frame.
Reasoning
Static method test helper returning the current frame for profiler coverage.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:397:22

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
        pytest.param(
            (lambda: inspect.currentframe())(),
            "<lambda>",
            id="lambda",
```
dismissed LLM, confidence 0.93 Parametrized test lambda returning the current frame.
Reasoning
Parametrized pytest case using a lambda that returns the current frame to check the profiler's handling of lambda frames. Test-only code.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:518:28

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    # look for in the final stack to make sure its in the right position
    base_stack_depth = len(inspect.stack()) + 1

    # increase the max_depth by the `base_stack_depth` to account
```
dismissed LLM, confidence 0.93 Test computes baseline stack depth via inspect.stack.
Reasoning
Computes the baseline stack depth with len(inspect.stack()) to set expected max_depth in a profiler test. Ordinary test arithmetic.
info ~~warn~~ → info by review frame-introspection tests/profiler/test_transaction_profiler.py:547:31

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    ("frame", "depth"),
    [(get_frame(depth=1), len(inspect.stack()))],
)
def test_extract_stack_with_cache(frame, depth):
```
dismissed LLM, confidence 0.93 Parametrize argument computing stack depth via inspect.stack.
Reasoning
Pytest parametrize value computes expected stack depth with inspect.stack() for a cache test of stack extraction. Test-only.
info ~~warn~~ → info by review frame-introspection tests/test_utils.py:525:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    frame = sys._getframe()
    result = serialize_frame(frame, include_source_context=include_source_context)
```
dismissed LLM, confidence 0.93 Test grabs the current frame to exercise frame serialization.
Reasoning
Test utility grabs the current frame with sys._getframe() and passes it to serialize_frame to verify frame serialization in the Sentry SDK. Expected for an SDK test suite.
info ~~warn~~ → info by review frame-introspection tests/test_utils.py:538:12

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    nickname = "Beans"  # noqa: F841
    return sys._getframe()
```
dismissed LLM, confidence 0.93 Test helper returning the current frame with a local variable present.
Reasoning
Test helper returns sys._getframe() after a local variable, so serialization of locals can be checked. Standard test technique.
info ~~warn~~ → info by review frame-introspection tests/test_utils.py:650:16

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def _frame_without_locals():
        return sys._getframe()

    sentry_init(data_collection={"stack_frame_variables": {"mode": "denylist"}})
```
dismissed LLM, confidence 0.93 Test helper returning a frame for denylist serialization checks.
Reasoning
Test helper returns the current frame to check denylist handling of stack frame variables in the SDK's data collection config. Test-only.
info ~~warn~~ → info by review frame-introspection tests/test_utils.py:761:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    frame = sys._getframe()
    with mock.patch("sentry_sdk.serializer.serialize", return_value=failure_message):
        result = serialize_frame(frame)
```
dismissed LLM, confidence 0.93 Test serializes the current frame with a mocked serializer failure.
Reasoning
Test grabs the current frame and serializes it while mocking the serializer to produce a failure message. Tests SDK error handling; no malicious behavior.
info ~~warn~~ → info by review dynamic-execution tests/utils/test_general.py:62:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    try:
        exec(code, {})
    except Exception:
        exceptions = exceptions_from_error_tuple(sys.exc_info())
```
likely benign LLM, confidence 0.80 A test helper calls exec on a supplied code string inside a try/except that collects raised exceptions.
Reasoning
The AST pass flags exec on a non-literal expression, but the context is a test utility. The snippet runs code with an empty globals dict and catches exceptions via exceptions_from_error_tuple(sys.exc_info()), which suggests a test helper that checks whether supplied code raises. The code is passed in by test authors, not fetched from an external source, and no network, encoding, or shell activity appears. Dynamic exec in test fixtures is common, so this looks benign, though the surrounding code is not shown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/getsentry/sentry-python sentry-python && cd sentry-python
git checkout 2.73.0
disclude scan --severity info --diff 2.72.0 .