Skip to content

graphsense-lib 2.20.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Oct 11:42
· 10 commits to master since this release
v2.20.1
005d2b6

[2.20.1] - 2026-10-30

Security fix: a failing graphsense-cli command no longer prints local variables, which included DB URLs with passwords, loaded configs and API keys. The API version stays 2.19.0 (no OpenAPI change, no new Python client).

Upgrade notes

  • Tracebacks no longer list local variables. Set GRAPHSENSE_TRACEBACK_LOCALS=1 to get them back for local debugging. If you kept logs of failing graphsense-cli runs, rotate the credentials that appear in them.

Library

Security

  • Tracebacks no longer list local variables. graphsense-cli printed every frame's locals on an uncaught exception (rich, show_locals=True), so a failing command wrote DB URLs with passwords, loaded configs and API keys into its output and from there into cron logs and log aggregation. Locals are now off; GRAPHSENSE_TRACEBACK_LOCALS=1 turns them back on for local debugging. If you collected such logs, rotate the credentials that appear in them.

Fixed

  • tagpack-tool tagstore show-source-repos no longer crashes on a tagpack without uri (NULL in the tagstore: AttributeError: 'NoneType' object has no attribute 'startswith'); such tagpacks show up as one empty entry.

Full Changelog: v2.20.0...v2.20.1

Assets 2
Loading