Skip to content

fix(releases): Normalize both release values to equal one another #101184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

fix(releases): Normalize both release values to equal one another #101184

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b1aa352
Normalize both release values to equal one another
cmanallen Oct 8, 2025
ada33b9
Fix types
cmanallen Oct 8, 2025
51b2c66
Add coverage
cmanallen Oct 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 47 additions & 8 deletions src/sentry/api/helpers/group_index/update.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
from collections import defaultdict
from collections.abc import Mapping, MutableMapping, Sequence
from http import HTTPStatus
from typing import Any, NotRequired, TypedDict
from typing import Any, NotRequired, TypedDict, cast
from urllib.parse import urlparse

import rest_framework
Expand Down Expand Up @@ -41,6 +41,7 @@
from sentry.models.groupinbox import GroupInboxRemoveAction, remove_group_from_inbox
from sentry.models.grouplink import GroupLink
from sentry.models.groupopenperiod import update_group_open_period
from sentry.models.grouprelease import GroupRelease
from sentry.models.groupresolution import GroupResolution
from sentry.models.groupseen import GroupSeen
from sentry.models.groupshare import GroupShare
Expand Down Expand Up @@ -154,7 +155,31 @@ def get_current_release_version_of_group(group: Group, follows_semver: bool = Fa
"""
current_release_version = None
if follows_semver:
release = greatest_semver_release(group.project)
# Fetch all the release-packages associated with the group. We'll find the largest semver
# version for one of these packages.
release_ids = list(
GroupRelease.objects.filter(
group_id=group.id,
project_id=group.project_id,
)
.distinct()
.values_list("release_id", flat=True)
)

group_packages = cast(
list[str],
list(
Release.objects.filter(
organization_id=group.project.organization_id,
id__in=release_ids,
package__isnull=False,
)
.distinct()
.values_list("package", flat=True)
Comment on lines +172 to +178
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High severity vulnerability may affect your project—review required:
Line 172 lists a dependency (django) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of django are vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). SQL injection in Django's ORM column aliases: when using QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), or QuerySet.extra() with dictionary expansion (**kwargs), the dictionary keys are used unescaped as SQL column aliases. On MySQL and MariaDB backends, an attacker who can influence those keys (for example, by passing a crafted dict of annotations) can inject arbitrary SQL into the generated query.

References: GHSA, CVE

To resolve this comment:
Check if you are using Django with MySQL or MariaDB.

  • If you're affected, upgrade this dependency to at least version 5.2.7 at uv.lock.
  • If you're not affected, comment /fp we don't use this [condition]
💬 Ignore this finding

To ignore this, reply with:

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

You can view more details on this finding in the Semgrep AppSec Platform here.

),
)

release = greatest_semver_release(group.project, packages=group_packages)
if release is not None:
current_release_version = release.version
else:
Expand Down Expand Up @@ -537,6 +562,10 @@ def process_group_resolution(
# in release
resolution_params.update(
{
"release": Release.objects.filter(
organization_id=release.organization_id,
version=current_release_version,
).get(),
"type": GroupResolution.Type.in_release,
"status": GroupResolution.Status.resolved,
}
Expand Down Expand Up @@ -819,7 +848,11 @@ def get_release_to_resolve_by(project: Project) -> Release | None:
follows_semver = follows_semver_versioning_scheme(
org_id=project.organization_id, project_id=project.id
)
return greatest_semver_release(project) if follows_semver else most_recent_release(project)
return (
greatest_semver_release(project, packages=[])
if follows_semver
else most_recent_release(project)
)


def most_recent_release(project: Project) -> Release | None:
Expand All @@ -841,14 +874,20 @@ def most_recent_release_matching_commit(
)


def greatest_semver_release(project: Project) -> Release | None:
return get_semver_releases(project).first()
def greatest_semver_release(project: Project, packages: list[str]) -> Release | None:
return get_semver_releases(project, packages).first()


def get_semver_releases(project: Project) -> QuerySet[Release]:
def get_semver_releases(project: Project, packages: list[str]) -> QuerySet[Release]:
query = Release.objects.filter(projects=project, organization_id=project.organization_id)

# Multiple packages may exist for a single project. If we were able to infer the packages
# associated with an issue we'll include them.
if packages:
query = query.filter(package__in=packages)

return (
Release.objects.filter(projects=project, organization_id=project.organization_id)
.filter_to_semver() # type: ignore[attr-defined]
query.filter_to_semver() # type: ignore[attr-defined]
.annotate_prerelease_column()
.order_by(*[f"-{col}" for col in Release.SEMVER_COLS])
)
Expand Down
Loading