sentry-structlog 3.0.0__tar.gz → 3.0.1__tar.gz

{sentry_structlog-3.0.0/sentry_structlog.egg-info → sentry_structlog-3.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sentry-structlog
-Version: 3.0.0
+Version: 3.0.1
 Summary: Sentry integration for structlog (thread-safe fork of structlog-sentry)
 Author-email: "Kiwi.com platform" <platform@kiwi.com>
 Maintainer: Barsoomx
@@ -207,10 +207,11 @@ The `SentryProcessor` class takes the following arguments:
 Add `structlog.stdlib.add_log_level` (or `add_log_level_number`) before the
 processor. `add_logger_name` is optional and also belongs before it. Names are
 resolved from non-empty strings in `event_dict["logger"]`, `_record.name`, then
-the wrapped logger's `name`. If the event dict has no `logger` key, the resolved
-name supplies the Sentry event logger and breadcrumb category without changing
-original event data. `CapturingLogger` and mock loggers without a string name
-are supported.
+the wrapped logger's `name`. The resolved name supplies the Sentry event logger
+and breadcrumb category even when the event dict's `logger` is `None`, empty,
+or not a string, without changing original event data. Without a resolved name,
+non-string values are omitted from the event logger and breadcrumb category.
+`CapturingLogger` and mock loggers without a string name are supported.
 
 ### Capture status
 
@@ -283,6 +284,8 @@ stack in `threads.values`, with `crashed=False` and `current=True`, even when
 `include_local_variables`, `include_source_context`, and `max_value_length`
 options. With `attach_stacktrace=True`, the SDK supplies the stack instead.
 Plain events without either flag only get a stack when that client option is on.
+Stacks captured by the processor omit `sentry_structlog`, `structlog`, and
+`logging` frames so raw log data in their locals cannot bypass context scrubbing.
 
 The processor leaves `exc_info`, `stack_info`, and `stack` unchanged for
 subsequent processors. If `StackInfoRenderer` ran first, the rendered `stack`
@@ -398,11 +401,17 @@ sentry_sdk.init(
 With this scrubber, `value="secret"` and `nested={"value": "s"}` are filtered in
 the context, and `value` is omitted from tags. `scrub=False` disables these
 processor-level protections; it does not disable the tag policy above. If the
-client has no event scrubber, the processor leaves context values and eligible
-tags unchanged. When configured, the SDK's event scrubber handles breadcrumb
+client has no event scrubber, the processor does not scrub context values or
+eligible tags. When configured, the SDK's event scrubber handles breadcrumb
 data while preparing the containing event, even with `scrub=False`; the
 processor does not scrub it a second time.
 
+Context and breadcrumb data use separate copies of dictionaries, lists, and
+tuples. Repeated references to these containers become `"<cyclic reference>"`,
+including shared containers without a cycle, so recursive scrubbing and
+serialization can finish. This also applies with `scrub=False` or no client
+scrubber. Original log values and callback hints remain unchanged.
+
 ### Scopes and thread isolation
 
 Configure shared processors as `SentryProcessor()` without `scope=`. In

{sentry_structlog-3.0.0 → sentry_structlog-3.0.1}/README.md

@@ -175,10 +175,11 @@ The `SentryProcessor` class takes the following arguments:
 Add `structlog.stdlib.add_log_level` (or `add_log_level_number`) before the
 processor. `add_logger_name` is optional and also belongs before it. Names are
 resolved from non-empty strings in `event_dict["logger"]`, `_record.name`, then
-the wrapped logger's `name`. If the event dict has no `logger` key, the resolved
-name supplies the Sentry event logger and breadcrumb category without changing
-original event data. `CapturingLogger` and mock loggers without a string name
-are supported.
+the wrapped logger's `name`. The resolved name supplies the Sentry event logger
+and breadcrumb category even when the event dict's `logger` is `None`, empty,
+or not a string, without changing original event data. Without a resolved name,
+non-string values are omitted from the event logger and breadcrumb category.
+`CapturingLogger` and mock loggers without a string name are supported.
 
 ### Capture status
 
@@ -251,6 +252,8 @@ stack in `threads.values`, with `crashed=False` and `current=True`, even when
 `include_local_variables`, `include_source_context`, and `max_value_length`
 options. With `attach_stacktrace=True`, the SDK supplies the stack instead.
 Plain events without either flag only get a stack when that client option is on.
+Stacks captured by the processor omit `sentry_structlog`, `structlog`, and
+`logging` frames so raw log data in their locals cannot bypass context scrubbing.
 
 The processor leaves `exc_info`, `stack_info`, and `stack` unchanged for
 subsequent processors. If `StackInfoRenderer` ran first, the rendered `stack`
@@ -366,11 +369,17 @@ sentry_sdk.init(
 With this scrubber, `value="secret"` and `nested={"value": "s"}` are filtered in
 the context, and `value` is omitted from tags. `scrub=False` disables these
 processor-level protections; it does not disable the tag policy above. If the
-client has no event scrubber, the processor leaves context values and eligible
-tags unchanged. When configured, the SDK's event scrubber handles breadcrumb
+client has no event scrubber, the processor does not scrub context values or
+eligible tags. When configured, the SDK's event scrubber handles breadcrumb
 data while preparing the containing event, even with `scrub=False`; the
 processor does not scrub it a second time.
 
+Context and breadcrumb data use separate copies of dictionaries, lists, and
+tuples. Repeated references to these containers become `"<cyclic reference>"`,
+including shared containers without a cycle, so recursive scrubbing and
+serialization can finish. This also applies with `scrub=False` or no client
+scrubber. Original log values and callback hints remain unchanged.
+
 ### Scopes and thread isolation
 
 Configure shared processors as `SentryProcessor()` without `scope=`. In

{sentry_structlog-3.0.0 → sentry_structlog-3.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sentry-structlog"
-version = "3.0.0"
+version = "3.0.1"
 description = "Sentry integration for structlog (thread-safe fork of structlog-sentry)"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -50,6 +50,7 @@ dev = [
     "ruff==0.15.17",
     "mypy==1.20.0",
     "twine>=6",
+    "pyright>=1.1.400",
 ]
 
 [tool.setuptools.packages.find]

{sentry_structlog-3.0.0 → sentry_structlog-3.0.1}/sentry_structlog/__init__.py

@@ -29,7 +29,7 @@ try:
     from structlog.processors import NAME_TO_LEVEL
 except ImportError:  # Older structlog versions expose the same mapping privately.
     from structlog.processors import (  # type: ignore[attr-defined,no-redef]
-        _NAME_TO_LEVEL as NAME_TO_LEVEL,
+        _NAME_TO_LEVEL as NAME_TO_LEVEL,  # pyright: ignore[reportAttributeAccessIssue]
     )
 
 
@@ -54,6 +54,7 @@ _TAG_KEY_PATTERN = re.compile(r"[a-zA-Z0-9_.:-]{1,32}")
 
 
 def _to_tag_value(value: object) -> str | None:
+    __tracebackhide__ = True
     if not isinstance(value, (str, int, float, bool, UUID, Decimal, Enum)):
         return None
     value = str(value)
@@ -62,13 +63,22 @@ def _to_tag_value(value: object) -> str | None:
     return value
 
 
-def _copy_scrub_data(value: Any) -> Any:
-    """Copy containers the scrubber mutates, leaving opaque log values untouched."""
+def _copy_scrub_data(value: Any, memo: set[int] | None = None) -> Any:
+    """Copy containers, replacing repeated references and preserving opaque values."""
+    __tracebackhide__ = True
+    if not isinstance(value, (dict, list, tuple)):
+        return value
+    if memo is None:
+        memo = set()
+    identity = id(value)
+    if identity in memo:
+        return "<cyclic reference>"
+    memo.add(identity)
     if isinstance(value, dict):
-        return {key: _copy_scrub_data(item) for key, item in value.items()}
+        return {key: _copy_scrub_data(item, memo) for key, item in value.items()}
     if isinstance(value, list):
-        return [_copy_scrub_data(item) for item in value]
-    return value
+        return [_copy_scrub_data(item, memo) for item in value]
+    return tuple(_copy_scrub_data(item, memo) for item in value)
 
 
 def _figure_out_exc_info(v: Any) -> ExcInfo | None:
@@ -77,6 +87,7 @@ def _figure_out_exc_info(v: Any) -> ExcInfo | None:
     to transform *v* into an ``exc_info`` tuple. Falsy flags become ``None``;
     the empty ``sys.exc_info()`` tuple is preserved to request a stack trace.
     """
+    __tracebackhide__ = True
     if isinstance(v, BaseException):
         return (v.__class__, v, v.__traceback__)
     elif isinstance(v, tuple):
@@ -172,6 +183,7 @@ class SentryProcessor:
         :param logger: logger instance
         :param event_dict: structlog event_dict
         """
+        __tracebackhide__ = True
         l_name = event_dict.get("logger")
         if isinstance(l_name, str) and l_name:
             return l_name
@@ -187,10 +199,12 @@ class SentryProcessor:
         return None
 
     def _get_scope(self) -> Scope:
+        __tracebackhide__ = True
         return self._scope or get_isolation_scope()
 
     @staticmethod
     def _get_hint(event_dict: EventDict) -> Hint:
+        __tracebackhide__ = True
         hint: Hint = {"structlog": dict(event_dict)}
         record = event_dict.get("_record")
         if isinstance(record, logging.LogRecord):
@@ -207,6 +221,7 @@ class SentryProcessor:
             `sentry_skip`, before capturing the event; used for tags and context.
             Defaults to `event_dict` itself.
         """
+        __tracebackhide__ = True
         if original_event_dict is None:
             original_event_dict = event_dict
 
@@ -222,24 +237,34 @@ class SentryProcessor:
                 mechanism={"type": "structlog", "handled": True},
             )
         else:
-            event, hint = {}, {}
+            event = {}
+            hint = {}
             # The SDK client supplies its own stack when attach_stacktrace is set.
             if (exc_info or event_dict.get("stack_info")) and not options.get(
                 "attach_stacktrace"
             ):
                 with capture_internal_exceptions():
+                    stacktrace = current_stacktrace(
+                        include_local_variables=options.get(
+                            "include_local_variables", True
+                        ),
+                        include_source_context=options.get(
+                            "include_source_context", True
+                        ),
+                        max_value_length=options.get("max_value_length"),
+                    )
+                    # Nonrecursive SDK scrubbing cannot clean nested event_dict locals.
+                    stacktrace["frames"] = [
+                        frame
+                        for frame in stacktrace["frames"]
+                        if not (frame.get("module") or "").startswith(
+                            ("sentry_structlog", "structlog", "logging")
+                        )
+                    ]
                     event["threads"] = {
                         "values": [
                             {
-                                "stacktrace": current_stacktrace(
-                                    include_local_variables=options.get(
-                                        "include_local_variables", True
-                                    ),
-                                    include_source_context=options.get(
-                                        "include_source_context", True
-                                    ),
-                                    max_value_length=options.get("max_value_length"),
-                                ),
+                                "stacktrace": stacktrace,
                                 "crashed": False,
                                 "current": True,
                             }
@@ -249,8 +274,9 @@ class SentryProcessor:
         # Structlog permits missing/dynamic values; preserve them for the SDK.
         event["message"] = event_dict.get("event")  # type: ignore[typeddict-item]
         event["level"] = event_dict.get("level")  # type: ignore[typeddict-item]
-        if "logger" in event_dict:
-            event["logger"] = event_dict["logger"]
+        logger_name = event_dict.get("logger")
+        if isinstance(logger_name, str):
+            event["logger"] = logger_name
 
         scrubber = (
             self._get_scope().get_client().options.get("event_scrubber")
@@ -258,11 +284,7 @@ class SentryProcessor:
             else None
         )
         if self._as_context:
-            context = (
-                _copy_scrub_data(original_event_dict)
-                if scrubber is not None and scrubber.recursive
-                else dict(original_event_dict)
-            )
+            context = _copy_scrub_data(original_event_dict)
             if isinstance(context.get("_record"), logging.LogRecord):
                 context.pop("_record")
             if scrubber is not None:
@@ -292,24 +314,27 @@ class SentryProcessor:
     def _get_breadcrumb_and_hint(
         self, event_dict: EventDict
     ) -> tuple[Breadcrumb, Hint]:
+        __tracebackhide__ = True
         data = {
             k: v
             for k, v in event_dict.items()
             if k not in self.ignore_breadcrumb_data
             and not (k == "_record" and isinstance(v, logging.LogRecord))
         }
+        logger_name = event_dict.get("logger")
         event: Breadcrumb = {
             "type": "log",
             "level": event_dict.get("level"),
-            "category": event_dict.get("logger"),
+            "category": logger_name if isinstance(logger_name, str) else None,
             "message": event_dict["event"],
             "timestamp": event_dict.get("timestamp"),
-            "data": data,
+            "data": _copy_scrub_data(data),
         }
 
         return event, self._get_hint(event_dict)
 
     def _can_record(self, logger_name: str | None, event_dict: EventDict) -> bool:
+        __tracebackhide__ = True
         if logger_name:
             for ignored_logger in _IGNORED_LOGGERS | self._ignored_loggers:
                 if fnmatch(logger_name, ignored_logger):
@@ -325,9 +350,10 @@ class SentryProcessor:
         sentry_level: LogLevelStr | None = None,
         logger_name: str | None = None,
     ) -> None:
+        __tracebackhide__ = True
         with capture_internal_exceptions():
             event, hint = self._get_event_and_hint(event_dict, original_event_dict)
-            if "logger" not in event_dict and logger_name is not None:
+            if logger_name is not None:
                 event["logger"] = logger_name
             if sentry_level is not None:
                 event["level"] = sentry_level
@@ -343,9 +369,10 @@ class SentryProcessor:
         sentry_level: str | None = None,
         logger_name: str | None = None,
     ) -> None:
+        __tracebackhide__ = True
         with capture_internal_exceptions():
             event, hint = self._get_breadcrumb_and_hint(event_dict)
-            if "logger" not in event_dict and logger_name is not None:
+            if logger_name is not None:
                 event["category"] = logger_name
             if sentry_level is not None:
                 event["level"] = sentry_level
@@ -354,6 +381,7 @@ class SentryProcessor:
     @staticmethod
     def _resolve_level(event_dict: EventDict) -> int | None:
         """Prefer a numeric level, then structlog aliases and registered names."""
+        __tracebackhide__ = True
         level = event_dict.get("level_number")
         if isinstance(level, int):
             return level
@@ -375,6 +403,7 @@ class SentryProcessor:
     @staticmethod
     def _get_sentry_level(level: int) -> LogLevelStr:
         """Map numeric ranges to Sentry severities, including custom levels."""
+        __tracebackhide__ = True
         if level >= logging.CRITICAL:
             return "fatal"
         if level >= logging.ERROR:
@@ -389,6 +418,7 @@ class SentryProcessor:
         self, logger: WrappedLogger, name: str, event_dict: EventDict
     ) -> EventDict:
         """A middleware to process structlog `event_dict` and send it to Sentry."""
+        __tracebackhide__ = True
         try:
             with capture_internal_exceptions():
                 sentry_skip = event_dict.pop("sentry_skip", False)

{sentry_structlog-3.0.0 → sentry_structlog-3.0.1/sentry_structlog.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sentry-structlog
-Version: 3.0.0
+Version: 3.0.1
 Summary: Sentry integration for structlog (thread-safe fork of structlog-sentry)
 Author-email: "Kiwi.com platform" <platform@kiwi.com>
 Maintainer: Barsoomx
@@ -207,10 +207,11 @@ The `SentryProcessor` class takes the following arguments:
 Add `structlog.stdlib.add_log_level` (or `add_log_level_number`) before the
 processor. `add_logger_name` is optional and also belongs before it. Names are
 resolved from non-empty strings in `event_dict["logger"]`, `_record.name`, then
-the wrapped logger's `name`. If the event dict has no `logger` key, the resolved
-name supplies the Sentry event logger and breadcrumb category without changing
-original event data. `CapturingLogger` and mock loggers without a string name
-are supported.
+the wrapped logger's `name`. The resolved name supplies the Sentry event logger
+and breadcrumb category even when the event dict's `logger` is `None`, empty,
+or not a string, without changing original event data. Without a resolved name,
+non-string values are omitted from the event logger and breadcrumb category.
+`CapturingLogger` and mock loggers without a string name are supported.
 
 ### Capture status
 
@@ -283,6 +284,8 @@ stack in `threads.values`, with `crashed=False` and `current=True`, even when
 `include_local_variables`, `include_source_context`, and `max_value_length`
 options. With `attach_stacktrace=True`, the SDK supplies the stack instead.
 Plain events without either flag only get a stack when that client option is on.
+Stacks captured by the processor omit `sentry_structlog`, `structlog`, and
+`logging` frames so raw log data in their locals cannot bypass context scrubbing.
 
 The processor leaves `exc_info`, `stack_info`, and `stack` unchanged for
 subsequent processors. If `StackInfoRenderer` ran first, the rendered `stack`
@@ -398,11 +401,17 @@ sentry_sdk.init(
 With this scrubber, `value="secret"` and `nested={"value": "s"}` are filtered in
 the context, and `value` is omitted from tags. `scrub=False` disables these
 processor-level protections; it does not disable the tag policy above. If the
-client has no event scrubber, the processor leaves context values and eligible
-tags unchanged. When configured, the SDK's event scrubber handles breadcrumb
+client has no event scrubber, the processor does not scrub context values or
+eligible tags. When configured, the SDK's event scrubber handles breadcrumb
 data while preparing the containing event, even with `scrub=False`; the
 processor does not scrub it a second time.
 
+Context and breadcrumb data use separate copies of dictionaries, lists, and
+tuples. Repeated references to these containers become `"<cyclic reference>"`,
+including shared containers without a cycle, so recursive scrubbing and
+serialization can finish. This also applies with `scrub=False` or no client
+scrubber. Original log values and callback hints remain unchanged.
+
 ### Scopes and thread isolation
 
 Configure shared processors as `SentryProcessor()` without `scope=`. In

{sentry_structlog-3.0.0 → sentry_structlog-3.0.1}/test/test_sentry_processor.py

@@ -1,3 +1,4 @@
+import json
 import logging
 import sys
 import threading
@@ -5,8 +6,9 @@ from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass, field
 from decimal import Decimal
 from enum import Enum
+from io import StringIO
 from unittest.mock import Mock
-from uuid import UUID
+from uuid import UUID, uuid4
 
 import pytest
 import sentry_sdk
@@ -487,6 +489,60 @@ def test_per_call_stack_without_exception(sentry_events, flags):
     assert {key: downstream[key] for key in flags} == flags
 
 
+@pytest.mark.parametrize(
+    "sentry_events", [{"include_local_variables": True}], indirect=True
+)
+@pytest.mark.parametrize("flag", ["stack_info", "exc_info"])
+@pytest.mark.parametrize("use_formatter", [False, True])
+def test_per_call_stack_does_not_leak_log_password(sentry_events, flag, use_formatter):
+    processor = SentryProcessor(tag_keys="__all__")
+    if use_formatter:
+        logger = logging.Logger("stack.logger")
+        handler = logging.StreamHandler(StringIO())
+        handler.setFormatter(
+            structlog.stdlib.ProcessorFormatter(
+                processors=[
+                    processor,
+                    structlog.stdlib.ProcessorFormatter.remove_processors_meta,
+                    structlog.processors.JSONRenderer(),
+                ]
+            )
+        )
+        logger.addHandler(handler)
+        processors = [structlog.stdlib.ProcessorFormatter.wrap_for_formatter]
+    else:
+        logger = structlog.ReturnLogger()
+        processors = [processor]
+    log = structlog.wrap_logger(
+        logger,
+        wrapper_class=structlog.stdlib.BoundLogger,
+        processors=[structlog.stdlib.add_log_level, *processors],
+    )
+    # A generated value avoids embedding the password in captured source context.
+    password = str(uuid4())
+    assert sys.exc_info() == (None, None, None)
+
+    log.error("stack requested", password=password, **{flag: True})
+
+    [event] = sentry_events
+    assert password not in json.dumps(event, default=str)
+    assert event["contexts"]["structlog"]["password"] == "[Filtered]"
+    assert event["tags"] == {}
+    frames = event["threads"]["values"][0]["stacktrace"]["frames"]
+    assert all(
+        not (frame.get("module") or "").startswith(
+            ("sentry_structlog", "structlog", "logging")
+        )
+        for frame in frames
+    )
+    [test_frame] = [
+        frame
+        for frame in frames
+        if frame["function"] == "test_per_call_stack_does_not_leak_log_password"
+    ]
+    assert test_frame["vars"]["password"] == "[Filtered]"
+
+
 @pytest.mark.parametrize("value", [None, False, 0, "", []])
 def test_falsy_exc_info_is_normalized_to_none(value):
     assert _figure_out_exc_info(value) is None
@@ -745,6 +801,13 @@ def test_logger_name_is_resolved_once_for_filter_and_payloads(sentry_events):
     "logger, record_name, event_name, expected_name",
     [
         (logging.getLogger("wrapped.logger"), absent, absent, "wrapped.logger"),
+        (MockLogger("wrapped.logger"), absent, None, "wrapped.logger"),
+        (MockLogger("wrapped.logger"), absent, 42, "wrapped.logger"),
+        (MockLogger("wrapped.logger"), absent, "", "wrapped.logger"),
+        (None, "record.logger", absent, "record.logger"),
+        (MockLogger("wrapped.logger"), "record.logger", None, "record.logger"),
+        (MockLogger("wrapped.logger"), "record.logger", 42, "record.logger"),
+        (MockLogger("wrapped.logger"), "record.logger", "", "record.logger"),
         (Mock(), "record.logger", absent, "record.logger"),
         (structlog.testing.CapturingLogger(), "record.logger", absent, "record.logger"),
         (MockLogger(None), "record.logger", absent, "record.logger"),
@@ -782,6 +845,23 @@ def test_resolved_logger_name_is_used_in_payloads(
     assert ("logger" in first["contexts"]["structlog"]) == (event_name is not absent)
 
 
+@pytest.mark.parametrize("event_name", [None, 42, Mock(), lambda: "name"])
+def test_nonstring_logger_without_fallback_is_omitted(sentry_events, event_name):
+    processor = SentryProcessor()
+    event_data = {"level": "error", "event": "first", "logger": event_name}
+
+    event, _ = processor._get_event_and_hint(event_data)
+    assert "logger" not in event
+    processor(None, "error", event_data)
+    sentry_sdk.capture_message("flush breadcrumb")
+
+    first, second = sentry_events
+    assert "logger" not in first
+    [breadcrumb] = second["breadcrumbs"]["values"]
+    assert breadcrumb.get("category") is None
+    assert event_data["logger"] is event_name
+
+
 @pytest.mark.parametrize("event_name", [None, "", 42, Mock(), lambda: "name"])
 def test_invalid_event_logger_name_falls_back_for_ignore_filter(
     sentry_events, event_name
@@ -1446,6 +1526,92 @@ def test_scrubbing_respects_nonrecursive_client_setting(sentry_events):
     assert event["contexts"]["structlog"]["nested"] == {"value": "s"}
 
 
+@pytest.mark.parametrize(
+    "sentry_events",
+    [
+        {"event_scrubber": EventScrubber(recursive=True)},
+        {"event_scrubber": EventScrubber()},
+    ],
+    indirect=True,
+    ids=["recursive", "nonrecursive"],
+)
+@pytest.mark.parametrize("scrub", [True, False])
+@pytest.mark.parametrize("container", ["dict", "list", "tuple"])
+def test_cyclic_kwargs_are_delivered_without_mutation(
+    sentry_events, sentry_hints, scrub, container
+):
+    if container == "dict":
+        value = {}
+        value["self"] = value
+        expected = {"self": "<cyclic reference>"}
+    elif container == "list":
+        value = []
+        value.append({"self": value})
+        expected = [{"self": "<cyclic reference>"}]
+    else:
+        items = []
+        value = (items,)
+        items.append(value)
+        expected = [["<cyclic reference>"]]
+    nested = {"child": {"cycle": value, "password": "nested password"}}
+    log = structlog.wrap_logger(
+        structlog.ReturnLogger(),
+        processors=[
+            structlog.stdlib.add_log_level,
+            SentryProcessor(scrub=scrub, tag_keys="__all__"),
+        ],
+    )
+
+    _, downstream = log.error("cyclic kwargs", nested=nested, password="top password")
+    sentry_sdk.capture_message("flush breadcrumb")
+
+    first, second = sentry_events
+    context = first["contexts"]["structlog"]
+    assert context["nested"]["child"]["cycle"] == expected
+    assert context["password"] == ("[Filtered]" if scrub else "top password")
+    recursive = sentry_sdk.get_client().options["event_scrubber"].recursive
+    assert context["nested"]["child"]["password"] == (
+        "[Filtered]" if scrub and recursive else "nested password"
+    )
+    assert first["tags"] == ({} if scrub else {"password": "top password"})
+    [breadcrumb] = second["breadcrumbs"]["values"]
+    # The SDK may stringify deeply nested breadcrumb values at its depth limit.
+    assert "<cyclic reference>" in json.dumps(
+        breadcrumb["data"]["nested"]["child"]["cycle"]
+    )
+    assert breadcrumb["data"]["password"] == "[Filtered]"
+    assert breadcrumb["data"]["nested"]["child"]["password"] == (
+        "[Filtered]" if recursive else "nested password"
+    )
+    assert downstream["nested"] is nested
+    assert nested["child"]["password"] == "nested password"
+    assert downstream["password"] == "top password"
+    if container == "dict":
+        assert value["self"] is value
+    elif container == "list":
+        assert value[0]["self"] is value
+    else:
+        assert value[0][0] is value
+    assert sentry_hints["events"][0]["structlog"]["nested"] is nested
+    assert sentry_hints["breadcrumbs"][0]["structlog"]["nested"] is nested
+
+
+@pytest.mark.parametrize("container", [dict, list, tuple])
+def test_repeated_containers_use_cycle_marker(sentry_events, container):
+    value = container()
+    SentryProcessor(tag_keys="__all__")(
+        None, "error", {"level": "error", "event": "aliases", "values": [value, value]}
+    )
+    sentry_sdk.capture_message("flush breadcrumb")
+
+    first, second = sentry_events
+    expected = [{} if container is dict else [], "<cyclic reference>"]
+    assert first["contexts"]["structlog"]["values"] == expected
+    assert first["tags"] == {}
+    [breadcrumb] = second["breadcrumbs"]["values"]
+    assert breadcrumb["data"]["values"] == expected
+
+
 def test_capture_without_client_scrubber(sentry_events, monkeypatch):
     client = sentry_sdk.get_client()
     monkeypatch.setitem(client.options, "event_scrubber", None)