sentry-sdk 3.0.0b1

Source: https://github.com/getsentry/sentry-python
Tag scanned: 3.0.0b1
Compared with: 3.0.0a7 (10 signals introduced since)
Files: 524 scanned, 42 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 18 info
Scan time: 12.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 17 of 17 warn and critical signals; 17 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-21 21:29

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review encoding-base64 sentry_sdk/consts.py:363:15 new in this release

base64-like blob (76 bytes, compression ratio 1.14) (raw pass, confidence 0.60)
```
    The AWS extended request ID as returned in the response headers.
    Example: "wzHcyEWfmOGDIE5QOhTAqFDoDWP3y8IUvpNINCwL9N4TEHbUw0/gZJ+VZTmCNCWR7fezEN3eCiQ="
    """
```
likely benign LLM, confidence 0.97 Example AWS extended request ID in a docstring.
Reasoning
The base64-like string is an example AWS request ID inside a docstring of an SDK constant file; it is documentation, not a payload.
info ~~warn~~ → info by review frame-introspection sentry_sdk/tracing_utils.py:284:39 new in this release

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    # Find the correct frame
    frame: "Union[FrameType, None]" = sys._getframe()
    while frame is not None:
        abs_path = _get_frame_module_abs_path(frame)
```
likely benign LLM, confidence 0.93 Stack frame walk to locate the caller's module path in Sentry SDK tracing.
Reasoning
Walking the stack with sys._getframe to find the correct caller frame for module path resolution is a standard, legitimate pattern in an error-reporting SDK.
info ~~warn~~ → info by review frame-introspection sentry_sdk/utils.py:655:32 new in this release

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    f: "Optional[FrameType]" = sys._getframe()
    while f is not None:
        if not should_hide_frame(f):
```
likely benign LLM, confidence 0.93 Walks call-stack frames to filter hidden frames for error reports.
Reasoning
Frame traversal to decide which frames to hide in reported stack traces is ordinary error-reporting logic in the SDK.
info ~~warn~~ → info by review decoder-decompress-payload tests/conftest.py:1653:34 new in this release

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            elif content_encoding == "br":
                rdr = io.BytesIO(brotli.decompress(request.data))
                compressed = True
            else:
```
likely benign LLM, confidence 0.95 Test helper decompresses HTTP request bodies for assertions.
Reasoning
Test fixture decompressing a request body with brotli or gzip to inspect captured envelopes; normal test infrastructure with no hidden payload.
info ~~warn~~ → info by review encoding-base64 tests/integrations/google_genai/test_google_genai.py:2180:26 new in this release

base64-like blob (104 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
            "inline_data": {
                "data": "iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAFUlEQVR42mP8z8BQz0AEYBxVSF+FABJADveWkH6oAAAAAElFTkSuQmCC",
                "mime_type": "image/png",
            }
```
likely benign LLM, confidence 0.96 Base64-encoded test PNG used as inline image data.
Reasoning
A tiny PNG image encoded as base64 in a test fixture for inline image data; expected test content.
info ~~warn~~ → info by review encoding-base64 tests/integrations/langchain/test_langchain.py:2672:47 new in this release

base64-like blob (96 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
            "image_url": {
                "url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
            },
        }
```
likely benign LLM, confidence 0.96 Base64 PNG data URL in a langchain test fixture.
Reasoning
Small base64 PNG data URL in a test fixture for image content; benign test data.
info ~~warn~~ → info by review encoding-base64 tests/integrations/langchain/test_langchain.py:2680:25 new in this release

base64-like blob (96 bytes, compression ratio 1.00) (raw pass, confidence 0.60)
```
            "mime_type": "image/png",
            "content": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
        }
```
likely benign LLM, confidence 0.96 Base64 PNG content in a langchain test fixture.
Reasoning
Same tiny base64 PNG test fixture appearing as content of an image part.
info ~~warn~~ → info by review encoding-base64 tests/integrations/pydantic_ai/test_pydantic_ai.py:2724:40 new in this release

base64-like blob (56 bytes, compression ratio 1.20) (raw pass, confidence 0.60)
```
        pytest.param(
            "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciLz4=",
            {},
            BLOB_DATA_SUBSTITUTE,
```
likely benign LLM, confidence 0.96 Base64 SVG data URL in a pydantic_ai parametrized test.
Reasoning
Base64 SVG data URL used as a parametrized test input; benign test data.
info ~~warn~~ → info by review frame-introspection tests/test_utils.py:486:12 new in this release

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    nickname = "Beans"  # noqa: F841
    return sys._getframe()
```
likely benign LLM, confidence 0.95 Test helper returning the current frame to check local variable capture.
Reasoning
Test helper returns sys._getframe() to test local variable capture; standard for testing frame-variable handling.
info ~~warn~~ → info by review frame-introspection tests/test_utils.py:593:16 new in this release

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    def _frame_without_locals():
        return sys._getframe()

    sentry_init(data_collection={"stack_frame_variables": {"mode": "denylist"}})
```
likely benign LLM, confidence 0.95 Test helper returning a frame for stack_frame_variables denylist testing.
Reasoning
Test helper returning the current frame to verify denylist of stack frame variables; benign test code.

info long-line README.md:83:1

line length 515 characters (raw pass, confidence 0.50)

Sentry integrates with a ton of popular Python libraries and frameworks, including [FastAPI](https://docs.sentry.io/platforms/python/integrations/fastapi/), [Django](https://docs.sentry.io/platforms/python/integrations/django/), [Celery](https://docs.sentry.io/platforms/python/integrations/celery/), [OpenAI](https://do

info ~~warn~~ → info by review decoder-decompress-payload tests/integrations/aws_lambda/utils.py:258:24

file imports decoder module(s) gzip and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            try:
                body = gzip.decompress(raw_body).decode("utf-8")
            except Exception:
                # If decompression fails, assume it's plain text
```
likely benign LLM, confidence 0.95 Test utility attempts gzip decompression with plaintext fallback.
Reasoning
Test utility tries gzip decompression of a raw body and falls back to plain text; standard handling of encoded test responses.
info ~~warn~~ → info by review frame-introspection tests/integrations/django/test_basic.py:1871:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            """
            return inspect.currentframe()

    class GetFrame:
```
likely benign LLM, confidence 0.94 Test helper returns the current frame for frame-variable tests.
Reasoning
Returns inspect.currentframe() inside a test helper class to verify frame-variable handling; a typical test construct.
info ~~warn~~ → info by review frame-introspection tests/integrations/django/test_basic.py:1883:20

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
            """
            return inspect.currentframe()

    instance = SimpleLazyObjectWrapper(lambda: GetFrame())
```
likely benign LLM, confidence 0.94 Test lazy-object wrapper returning the current frame.
Reasoning
Same test helper pattern wrapping a lazy object, used to exercise frame capture in tests.
info ~~critical~~ → info by review dynamic-execution tests/integrations/gcp/test_gcp.py:122:13

`subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
            subprocess.check_call(
                "uv pip install -p {} ../*.tar.gz --target .".format(sys.executable),
                cwd=tmpdir,
```
likely benign LLM, confidence 0.90 Test runs uv pip install via a shell command with a temp directory.
Reasoning
Test installs a locally built package via a shell command built with format using sys.executable and a tmpdir; the inputs are controlled test values, not attacker-supplied, so it is not a real threat, though shell=True is worth noting.
info ~~critical~~ → info by review dynamic-execution tests/integrations/gcp/test_gcp.py:129:22

`os.popen` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)
```
            stream = os.popen("python {}/main.py".format(tmpdir))
            stream_data = stream.read()
```
likely benign LLM, confidence 0.90 Test executes a generated main.py via os.popen.
Reasoning
Test runs a local main.py through os.popen with a temp directory path; the interpolated value is test-controlled, so no malicious intent is evident.
info ~~warn~~ → info by review frame-introspection tests/test_utils.py:652:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    frame = sys._getframe()
    with mock.patch("sentry_sdk.serializer.serialize", return_value=failure_message):
        result = serialize_frame(frame)
```
likely benign LLM, confidence 0.93 Test code obtains the current stack frame to feed into a serialization helper under a mock.
Reasoning
sys._getframe() is used in a test to build a frame object that is passed to serialize_frame while mocking the sentry serializer. This is ordinary test scaffolding for a Sentry SDK, with no network, encoding, or evasion behavior.
info ~~warn~~ → info by review dynamic-execution tests/utils/test_general.py:63:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    try:
        exec(code, {})
    except Exception:
        exceptions = exceptions_from_error_tuple(sys.exc_info())
```
likely benign LLM, confidence 0.90 Test code uses exec on a generated code string to produce a real exception traceback for parsing.
Reasoning
exec is run on a variable inside a test of exception extraction in what appears to be the Sentry SDK test suite. The code is executed in a fresh empty globals dict to generate a real traceback, which is a standard testing technique. The snippet shows no decoding or remote source, and the file is a test.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/getsentry/sentry-python sentry-python && cd sentry-python
git checkout 3.0.0b1
disclude scan --severity info --diff 3.0.0a7 .