bugsink 2.2.0__tar.gz → 2.2.2__tar.gz

{bugsink-2.2.0 → bugsink-2.2.2}/.github/workflows/ci.yml

@@ -25,9 +25,9 @@ jobs:
   ruff:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: "Set up Python 3.12"
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.12"
     - name: Install Ruff
@@ -40,10 +40,10 @@ jobs:
   bandit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.12
 
@@ -106,9 +106,9 @@ jobs:
       DB_USER: ${{ matrix.db_user }}
       DB_PASSWORD: ${{ matrix.db_password }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
     - name: Start MySQL If Needed
@@ -134,7 +134,7 @@ jobs:
         pip install -r requirements.development.txt
         pip install mysqlclient psycopg2
     - name: Check out event-samples
-      uses: actions/checkout@master
+      uses: actions/checkout@v6
       with:
         repository: bugsink/event-samples
         path: "event-samples"
@@ -169,17 +169,17 @@ jobs:
     # Build the Docker image, start it, wait for readiness, log in at /accounts/login/,
     # and verify that / redirects to /teams/.
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build Docker image
         run: docker build -t bugsink-ci .
 
-      - name: Run container (admin:admin)
+      - name: Run container (no-reply@bugsink.com:admin)
         run: |
           docker rm -f bugsink-ci || true
           docker run -d --name bugsink-ci \
             -e SECRET_KEY=UtdHATKzQKLkz3izFFpxCKamhEdspeHmCQFvLx1DAwskqEuyKL \
-            -e CREATE_SUPERUSER=admin:admin \
+            -e CREATE_SUPERUSER=no-reply@bugsink.com:admin \
             -e PORT=8000 \
             -p 8000:8000 \
             bugsink-ci
@@ -214,7 +214,7 @@ jobs:
           CODE=$(curl -sS -b cookies.txt -c cookies.txt \
             -H "Content-Type: application/x-www-form-urlencoded" \
             -H "Referer: http://localhost:8000/accounts/login/" \
-            -d "username=admin&password=admin&csrfmiddlewaretoken=${CSRF}&next=/" \
+            -d "username=no-reply@bugsink.com&password=admin&csrfmiddlewaretoken=${CSRF}&next=/" \
             -o /dev/null -w "%{http_code}" \
             http://localhost:8000/accounts/login/)
 
@@ -236,3 +236,7 @@ jobs:
           fi
 
           echo "Login OK and / redirects to /teams/"
+
+      - name: Show Docker logs
+        if: always()
+        run: docker logs bugsink-ci || true

{bugsink-2.2.0 → bugsink-2.2.2}/.github/workflows/copilot-setup-steps.yml

@@ -19,14 +19,14 @@ jobs:
       SAMPLES_DIR: ${{ github.workspace }}/event-samples
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install project `pre-commit` hook
         run: |
           cp pre-commit .git/hooks/pre-commit
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 

{bugsink-2.2.0 → bugsink-2.2.2}/CHANGELOG.md

@@ -1,6 +1,39 @@
 # Changes
 
-## 2.2.0 (19 May 2026)
+## 2.2.2 (4 June 2026)
+
+### Security
+
+Fix: cap the number of tags stored per event.
+
+Events with very many tags could keep the single write transaction busy for longer than intended during digestion.
+Bugsink now stores at most `MAX_EVENT_TAGS` tags per event, defaulting to 100.
+
+https://github.com/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj
+
+### Smaller fixes
+
+* Show project slugs as read-only on project settings pages, see #402.
+
+## 2.2.1 (22 May 2026)
+
+### API
+
+* Add issue actions to the canonical API, see #214 and #401.
+* Add canonical API issue comment creation, see #352 and #401.
+* Accept issue friendly IDs in the canonical API, see #389 and #401.
+* Improve OpenAPI endpoint docs, see #390 and #401.
+* Use Bugsink's version as the OpenAPI spec version, see #307.
+
+### Smaller fixes
+
+* Fix long module names overlapping version values on event detail pages, see #377 and #382.
+* Validate `CREATE_SUPERUSER` email addresses and use the email as username in Docker server-start setup, see #394.
+* Development server: do not send email by default, see d6d5190441b3.
+* Docker: disable Gunicorn's unused control socket, see #405.
+* Sourcemap uploads without a project slug now log server-side context before returning `400`, see #404 and #408.
+
+## 2.2.0 (21 May 2026)
 
 ### Security
 
@@ -26,6 +59,7 @@ https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8
 
 ### Smaller fixes
 
+* Fix health-check `ALLOWED_HOSTS`-ignore, see #140, #397
 * Generate an `event_id` on `/store/` when the SDK does not send one, see #383.
 * Refresh issue title fields on every event digest, see #378.
 * Include ingest-dir cleanup in the `vacuum` command and warn about stale ingest-dir files, see 772fb1a9bff6 and

{bugsink-2.2.0 → bugsink-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bugsink
-Version: 2.2.0
+Version: 2.2.2
 Summary: Self-hosted Error Tracking
 Author-email: "Bugsink B.V." <info@bugsink.com>
 Project-URL: homepage, https://www.bugsink.com/

{bugsink-2.2.0 → bugsink-2.2.2}/bsmain/management/commands/prestart.py

@@ -2,6 +2,8 @@ import os
 
 from django.core.management.base import BaseCommand
 from django.contrib.auth import get_user_model
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
 
 from phonehome.tasks import send_if_due
 
@@ -17,7 +19,7 @@ class Command(BaseCommand):
             return
 
         if ":" not in os.getenv("CREATE_SUPERUSER"):
-            raise ValueError("CREATE_SUPERUSER should be in the format 'username:password'")
+            raise ValueError("CREATE_SUPERUSER should be in the format 'email:password'")
 
         username, password = os.getenv("CREATE_SUPERUSER").split(":", 1)
 
@@ -28,7 +30,14 @@ class Command(BaseCommand):
 
             return
 
-        User.objects.create_superuser(username=username, password=password)
+        # Validate only when we're actually creating the user, so existing installations with a stale
+        # CREATE_SUPERUSER value keep starting normally.
+        try:
+            validate_email(username)
+        except ValidationError as e:
+            raise ValueError("CREATE_SUPERUSER email should be a valid email address") from e
+
+        User.objects.create_superuser(username=username, email=username, password=password)
         print(f"Superuser created: {username}")
 
     def handle(self, *args, **options):

{bugsink-2.2.0 → bugsink-2.2.2}/bsmain/management/commands/send_json.py

@@ -12,6 +12,7 @@ from django.core.management.base import BaseCommand, CommandError
 from django.conf import settings
 
 from compat.dsn import get_store_url, get_envelope_url, get_header_value
+from bugsink.app_settings import get_settings
 from bugsink.streams import compress_with_zlib, WBITS_PARAM_FOR_GZIP, WBITS_PARAM_FOR_DEFLATE
 from bugsink.utils import nc_rnd
 
@@ -31,6 +32,7 @@ class Command(BaseCommand):
         parser.add_argument("--compress", action="store", choices=["gzip", "deflate", "br"], default=None)
         parser.add_argument("--use-store-api", action="store_true", help="Use (deprecated) /api/<id>/store/")
         parser.add_argument("--chunked-encoding", action="store_true")
+        parser.add_argument("--respect-limits", action="store_true", help="Use client-side size-limit checks")
         parser.add_argument(
             "--x-forwarded-for", action="store",
             help="Set the X-Forwarded-For header to test whether your setup is properly ignoring it")
@@ -132,6 +134,14 @@ class Command(BaseCommand):
         if options["valid_only"] and not self.is_valid(data, identifier):
             return False
 
+        data_bytes = json.dumps(data, separators=(",", ":")).encode("utf-8")
+
+        # For now this only checks the event item size; we'll add other limit checks as needed.
+        if options["respect_limits"] and len(data_bytes) >= get_settings().MAX_EVENT_SIZE:
+            raise CommandError(
+                "Event JSON is %d bytes, which would hit the %d byte event-size limit" % (
+                    len(data_bytes), get_settings().MAX_EVENT_SIZE))
+
         try:
             headers = {
                 "Content-Type": "application/json",
@@ -141,7 +151,6 @@ class Command(BaseCommand):
             if options["x_forwarded_for"]:
                 headers["X-Forwarded-For"] = options["x_forwarded_for"]
 
-            data_bytes = json.dumps(data).encode("utf-8")
             if use_envelope:
                 event_id = data.get("event_id", uuid.uuid4().hex)
 

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.2.0'
-__version_tuple__ = version_tuple = (2, 2, 0)
+__version__ = version = '2.2.2'
+__version_tuple__ = version_tuple = (2, 2, 2)
 
-__commit_id__ = commit_id = 'gdac28a708'
+__commit_id__ = commit_id = 'gdd17221c0'

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/app_settings.py

@@ -78,6 +78,10 @@ DEFAULTS = {
     # I don't think Sentry specifies this one, but we do: given the spec 8KiB should be enough by an order of magnitude.
     "MAX_HEADER_SIZE": 8 * _KIBIBYTE,
 
+    # Cap on the number of tags stored per event. Without it, a single event with very many tags becomes ~4x that
+    # many row-writes inside the (single-writer) digest transaction. 100 is well above any realistic event.
+    "MAX_EVENT_TAGS": 100,
+
     # Locations of files & directories:
     # no_bandit_expl: the usage of this path (via get_filename_for_event_id) is protected with `b108_makedirs`
     "INGEST_STORE_BASE_DIR": "/tmp/bugsink/ingestion",  # nosec

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/conf_templates/docker.py.template

@@ -175,6 +175,7 @@ BUGSINK = {
     "MAX_EVENT_COMPRESSED_SIZE": int(os.getenv("MAX_EVENT_COMPRESSED_SIZE", 200 * _KIBIBYTE)),
     "MAX_ENVELOPE_SIZE": int(os.getenv("MAX_ENVELOPE_SIZE", 100 * _MEBIBYTE)),
     "MAX_ENVELOPE_COMPRESSED_SIZE": int(os.getenv("MAX_ENVELOPE_COMPRESSED_SIZE", 20 * _MEBIBYTE)),
+    "MAX_EVENT_TAGS": int(os.getenv("MAX_EVENT_TAGS", 100)),
     # For large MAX_FILE_SIZE values, you may want FILE_OBJECT_STORAGE_PATH configured too.
     "MAX_FILE_SIZE": int(os.getenv("MAX_FILE_SIZE", 2 * _GIBIBYTE)),
 

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/conf_templates/local.py.template

@@ -80,6 +80,7 @@ BUGSINK = {
 
     # For large MAX_FILE_SIZE values, you may want OBJECT_STORAGES["file"] configured too.
     # "MAX_FILE_SIZE": 2 * _GIBIBYTE,
+    # "MAX_EVENT_TAGS": 100,
 
     # Webhook outbound security:
     # "ALERTS_WEBHOOK_OUTBOUND_MODE": "open",  # or "allowlist_only"

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/conf_templates/singleserver.py.template

@@ -112,6 +112,7 @@ BUGSINK = {
     # "MAX_EVENT_COMPRESSED_SIZE": 200 * _KIBIBYTE,
     # "MAX_ENVELOPE_SIZE": 100 * _MEBIBYTE,
     # "MAX_ENVELOPE_COMPRESSED_SIZE": 20 * _MEBIBYTE,
+    # "MAX_EVENT_TAGS": 100,
     # For large MAX_FILE_SIZE values, you may want OBJECT_STORAGES["file"] configured too.
     # "MAX_FILE_SIZE": 2 * _GIBIBYTE,
 

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/gunicorn.docker.conf.py

@@ -1,4 +1,5 @@
 # gunicorn config file for Docker deployments
 import multiprocessing
 
+control_socket_disable = True
 workers = min(multiprocessing.cpu_count(), 4)

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/settings/default.py

@@ -6,6 +6,9 @@ from pathlib import Path
 
 from django.utils.log import DEFAULT_LOGGING
 
+from ..version import version as __version__
+
+
 # We have a single file for our default settings, and expect (if they use the singleserver setup) the end-users to
 # configure their setup using a single bugsink_conf.py also. To be able to have (slightly) different settings for e.g.
 # logging for various commands, we expose a variable I_AM_RUNNING that can be used to determine what command is being
@@ -90,7 +93,7 @@ REST_FRAMEWORK = {
 SPECTACULAR_SETTINGS = {
     'TITLE': 'Bugsink',
     'DESCRIPTION': 'Bugsink API Documentation',
-    'VERSION': '1.0.0',
+    'VERSION': __version__,
     'SERVE_INCLUDE_SCHEMA': False,  # keep the docs clean and not document the docs endpoint itself.
 
     "SECURITY": [

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/settings/development.py

@@ -73,11 +73,12 @@ SNAPPEA = {
     "PID_FILE": "/tmp/bugsink/snappea.pid",  # nosec B108
 }
 
-EMAIL_HOST = os.getenv("EMAIL_HOST")
-EMAIL_HOST_USER = os.getenv("EMAIL_HOST_USER")
-EMAIL_HOST_PASSWORD = os.getenv("EMAIL_HOST_PASSWORD")
-EMAIL_PORT = 587
-EMAIL_USE_TLS = True
+EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
+# EMAIL_HOST = os.getenv("EMAIL_HOST")
+# EMAIL_HOST_USER = os.getenv("EMAIL_HOST_USER")
+# EMAIL_HOST_PASSWORD = os.getenv("EMAIL_HOST_PASSWORD")
+# EMAIL_PORT = 587
+# EMAIL_USE_TLS = True
 
 SERVER_EMAIL = DEFAULT_FROM_EMAIL = 'Bugsink Development Server <bugsink@example.org>'
 

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink/urls.py

@@ -18,7 +18,7 @@ from files.views import chunk_upload, artifact_bundle_assemble, difs_assemble, a
 from bugsink.decorators import login_exempt
 
 from events.api_views import EventViewSet
-from issues.api_views import IssueViewSet
+from issues.api_views import IssueCommentViewSet, IssueViewSet
 from projects.api_views import ProjectViewSet
 from releases.api_views import ReleaseViewSet
 from teams.api_views import TeamViewSet
@@ -34,6 +34,7 @@ admin.site.index_title = "Admin"  # everyone calls this the "admin" anyway. Let'
 
 api_router = routers.DefaultRouter()
 api_router.register(r'events', EventViewSet)
+api_router.register(r'issue-comments', IssueCommentViewSet, basename='issue-comment')
 api_router.register(r'issues', IssueViewSet)
 api_router.register(r'projects', ProjectViewSet)
 api_router.register(r'releases', ReleaseViewSet)

{bugsink-2.2.0 → bugsink-2.2.2}/bugsink.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bugsink
-Version: 2.2.0
+Version: 2.2.2
 Summary: Self-hosted Error Tracking
 Author-email: "Bugsink B.V." <info@bugsink.com>
 Project-URL: homepage, https://www.bugsink.com/

{bugsink-2.2.0 → bugsink-2.2.2}/events/api_views.py

@@ -3,12 +3,13 @@ from rest_framework import viewsets
 from rest_framework.exceptions import ValidationError
 from rest_framework.decorators import action
 from rest_framework.response import Response
-from drf_spectacular.utils import extend_schema, OpenApiParameter, OpenApiTypes, OpenApiResponse
+from drf_spectacular.utils import extend_schema, OpenApiExample, OpenApiParameter, OpenApiTypes, OpenApiResponse
 
 
 from bugsink.utils import assert_
 from bugsink.api_pagination import AscDescCursorPagination
 from bugsink.api_mixins import AtomicRequestMixin
+from issues.models import issue_lookup_kwargs
 
 from .models import Event
 from .serializers import EventListSerializer, EventDetailSerializer
@@ -26,12 +27,6 @@ class EventPagination(AscDescCursorPagination):
 
 
 class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
-    """
-    LIST requires: ?issue=<uuid>
-    Optional: ?order=asc|desc   (default: desc)
-    LIST omits `data`, ordered by digest_order
-    RETRIEVE includes `data` (pure PK lookup; no filters/order applied)
-    """
     queryset = Event.objects.all()  # router requirement for basename inference
     serializer_class = EventListSerializer
     pagination_class = EventPagination
@@ -42,16 +37,19 @@ class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
         if "issue" not in query_params:
             raise ValidationError({"issue": ["This field is required."]})
 
-        return queryset.filter(issue=query_params["issue"])
+        lookup_kwargs = {"issue__" + k: v for k, v in issue_lookup_kwargs(query_params["issue"]).items()}
+        return queryset.filter(issue__is_deleted=False, **lookup_kwargs)
 
     @extend_schema(
+        summary="List events",
+        description="List events for an issue. The list response omits the full event `data` payload.",
         parameters=[
             OpenApiParameter(
                 name="issue",
-                type=OpenApiTypes.UUID,
+                type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 required=True,
-                description="Filter events by issue UUID (required).",
+                description="Filter events by issue UUID or friendly ID (required).",
             ),
             OpenApiParameter(
                 name="order",
@@ -66,6 +64,17 @@ class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
     def list(self, request, *args, **kwargs):
         return super().list(request, *args, **kwargs)
 
+    @extend_schema(
+        summary="Retrieve an event",
+        description=(
+            "Retrieve an event by internal Bugsink event UUID. "
+            "The detail response includes the full `data` payload."
+        ),
+        responses=EventDetailSerializer,
+    )
+    def retrieve(self, request, *args, **kwargs):
+        return super().retrieve(request, *args, **kwargs)
+
     def get_object(self):
         """
         DRF's get_object(), but we intentionally bypass filter_queryset for detail routes to keep PK lookups
@@ -94,8 +103,21 @@ class EventViewSet(AtomicRequestMixin, viewsets.ReadOnlyModelViewSet):
         return EventDetailSerializer if self.action == "retrieve" else EventListSerializer
 
     @extend_schema(
+        summary="Render an event stacktrace",
         description="Render the event's stacktrace (frames, source, locals) as Markdown-like text.",
-        responses={200: OpenApiResponse(response=str, description="Stacktrace as Markdown")},
+        responses={
+            200: OpenApiResponse(
+                response=str,
+                description="Stacktrace as Markdown",
+                examples=[
+                    OpenApiExample(
+                        "Stacktrace",
+                        value="Traceback (most rece...",
+                        response_only=True,
+                    ),
+                ],
+            )
+        },
     )
     @action(
         detail=True,

{bugsink-2.2.0 → bugsink-2.2.2}/files/views.py

@@ -238,6 +238,7 @@ def artifact_bundle_assemble(request, organization_slug):
     chunk_checksums = data["chunks"]
     projects, error = get_artifact_bundle_projects(data)
     if error is not None:
+        logger.warning("Rejected artifact bundle: project slug is missing or does not match an existing project.")
         return JsonResponse({"error": error}, status=400)
 
     # sentry-cli >= 3.x calls this endpoint before uploading chunks (to learn which ones are missing), then uploads