From 08fe9e0d9a2163d67293d3d5ba62877f2684213a Mon Sep 17 00:00:00 2001 From: Rohan Dhiman Date: Wed, 12 Aug 2026 17:11:12 +0530 Subject: [PATCH 1/3] SCA Finding fixed --- .github/workflows/maze-runner.yml | 3 +++ .github/workflows/python-package.yml | 5 +++++ CHANGELOG.md | 1 + example/celery+django/celery_django/settings.py | 5 ++++- example/django21/bugsnag_demo/settings.py | 5 ++++- example/django31/todo/settings.py | 5 ++++- tests/fixtures/django30/todo/settings.py | 2 +- tests/fixtures/django4/todo/settings.py | 2 +- tests/fixtures/django5/todo/settings.py | 2 +- tests/fixtures/django6/todo/settings.py | 2 +- 10 files changed, 25 insertions(+), 7 deletions(-) diff --git a/.github/workflows/maze-runner.yml b/.github/workflows/maze-runner.yml index 85d26756..17297807 100644 --- a/.github/workflows/maze-runner.yml +++ b/.github/workflows/maze-runner.yml @@ -2,6 +2,9 @@ name: Maze Runner on: [push, pull_request] +permissions: + contents: read + jobs: maze-runner: runs-on: 'ubuntu-latest' diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 5cfef9cf..d945445f 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -2,6 +2,9 @@ name: Test bugsnag-python against Python versions on: [ push, pull_request ] +permissions: + contents: read + jobs: test: runs-on: ${{ matrix.os }} @@ -46,6 +49,8 @@ jobs: needs: test runs-on: ubuntu-latest container: python:3-slim + permissions: + contents: none steps: - name: Send request run: | diff --git a/CHANGELOG.md b/CHANGELOG.md index 39eebfee..7c3d525b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Changelog ### Enhancements * Add support for `level` parameter in `BugsnagHandler` constructor and `Client.log_handler()` method. + [#416](https://github.com/bugsnag/bugsnag-python/pull/416) ## v4.9.0 (2026-04-21) diff --git a/example/celery+django/celery_django/settings.py b/example/celery+django/celery_django/settings.py index 7fe170c8..c52f75bd 100644 --- a/example/celery+django/celery_django/settings.py +++ b/example/celery+django/celery_django/settings.py @@ -20,7 +20,10 @@ # See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = 't70qw62gdx%ru%w1&f#$so*a$h9-m6h#a1=gji9$5q&)exf$*%' +SECRET_KEY = os.environ.get( + 'DJANGO_SECRET_KEY', + 'django-insecure-testonly-not-a-real-secret-key-replace-me', +) # SECURITY WARNING: don't run with debug turned on in production! DEBUG = True diff --git a/example/django21/bugsnag_demo/settings.py b/example/django21/bugsnag_demo/settings.py index ecc58277..e4885815 100644 --- a/example/django21/bugsnag_demo/settings.py +++ b/example/django21/bugsnag_demo/settings.py @@ -18,7 +18,10 @@ # See https://docs.djangoproject.com/en/2.0/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = '3n3h7r@tpqnwqtt8#avxh_t75k_6zf3x)@6cg!u(&xmz79(26h' +SECRET_KEY = os.environ.get( + 'DJANGO_SECRET_KEY', + 'django-insecure-testonly-not-a-real-secret-key-replace-me', +) # SECURITY WARNING: don't run with debug turned on in production! DEBUG = True diff --git a/example/django31/todo/settings.py b/example/django31/todo/settings.py index 80ddedb5..2dc42416 100644 --- a/example/django31/todo/settings.py +++ b/example/django31/todo/settings.py @@ -22,7 +22,10 @@ # See https://docs.djangoproject.com/en/3.1/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = '$#yb)ri-v$^#8o1r0x%5$0yy&aqu2yefwo10zm+(=7!t+d^6ft' +SECRET_KEY = os.environ.get( + 'DJANGO_SECRET_KEY', + 'django-insecure-testonly-not-a-real-secret-key-replace-me', +) # SECURITY WARNING: don't run with debug turned on in production! DEBUG = True diff --git a/tests/fixtures/django30/todo/settings.py b/tests/fixtures/django30/todo/settings.py index ac11d39f..8f505374 100644 --- a/tests/fixtures/django30/todo/settings.py +++ b/tests/fixtures/django30/todo/settings.py @@ -22,7 +22,7 @@ # See https://docs.djangoproject.com/en/3.0/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = '$#yb)ri-v$^#8o1r0x%5$0yy&aqu2yefwo10zm+(=7!t+d^6ft' +SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me' # SECURITY WARNING: don't run with debug turned on in production! DEBUG = False diff --git a/tests/fixtures/django4/todo/settings.py b/tests/fixtures/django4/todo/settings.py index 1458b48a..1fead5d2 100644 --- a/tests/fixtures/django4/todo/settings.py +++ b/tests/fixtures/django4/todo/settings.py @@ -21,7 +21,7 @@ # See https://docs.djangoproject.com/en/4.0/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z' +SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me' # SECURITY WARNING: don't run with debug turned on in production! DEBUG = False diff --git a/tests/fixtures/django5/todo/settings.py b/tests/fixtures/django5/todo/settings.py index 378ee386..1afec6cd 100644 --- a/tests/fixtures/django5/todo/settings.py +++ b/tests/fixtures/django5/todo/settings.py @@ -21,7 +21,7 @@ # See https://docs.djangoproject.com/en/5.0/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z' +SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me' # SECURITY WARNING: don't run with debug turned on in production! DEBUG = False diff --git a/tests/fixtures/django6/todo/settings.py b/tests/fixtures/django6/todo/settings.py index c0cee231..6532fbe8 100644 --- a/tests/fixtures/django6/todo/settings.py +++ b/tests/fixtures/django6/todo/settings.py @@ -21,7 +21,7 @@ # See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! -SECRET_KEY = 'django-insecure-z++&i7gx^m*qqq_1(xjqo=7%gg)^&fcq6fa3gen+10(zn5756z' +SECRET_KEY = 'django-insecure-testonly-not-a-real-secret-key-replace-me' # SECURITY WARNING: don't run with debug turned on in production! DEBUG = False From 82e495bcf7d0827510b212408f25434336f5d3ca Mon Sep 17 00:00:00 2001 From: SB-khushbum Date: Tue, 15 Sep 2026 15:44:50 +0530 Subject: [PATCH 2/3] SCA fixes for PLAT-17181 (#424) --- example/celery+django/requirements.txt | 2 +- example/flask/requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/example/celery+django/requirements.txt b/example/celery+django/requirements.txt index 6134a7fc..327f8bc4 100644 --- a/example/celery+django/requirements.txt +++ b/example/celery+django/requirements.txt @@ -8,4 +8,4 @@ markdown==3.4.1 pytz==2022.5 redis==4.3.4 vine==5.0.0 -WebOb==1.8.7 +WebOb==1.8.11 diff --git a/example/flask/requirements.txt b/example/flask/requirements.txt index dc354751..ec0770f6 100644 --- a/example/flask/requirements.txt +++ b/example/flask/requirements.txt @@ -5,5 +5,5 @@ Flask==1.1.2 itsdangerous==1.1.0 Jinja2==2.11.2 MarkupSafe==1.1.1 -WebOb==1.8.6 +WebOb==1.8.11 Werkzeug==1.0.1 From d69eb08b203822b002204a2f74ffcb37931f5e3d Mon Sep 17 00:00:00 2001 From: Shivam Garg Date: Tue, 15 Sep 2026 15:46:49 +0530 Subject: [PATCH 3/3] release v4.9.2 --- CHANGELOG.md | 7 +++++++ bugsnag/__init__.py | 2 +- bugsnag/notifier.py | 2 +- setup.py | 2 +- 4 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7c3d525b..1fbe231f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,13 @@ Changelog ========= +## v4.9.2 (2026-09-15) + +### Security + +* Replace hardcoded Django `SECRET_KEY` values with environment variables in example apps and test fixtures [#423](https://github.com/bugsnag/bugsnag-python/pull/423) +* Upgrade WebOb to 1.8.11 in example apps to remediate known security vulnerabilities [#424](https://github.com/bugsnag/bugsnag-python/pull/424) + ## v4.9.1 (2026-06-18) ### Enhancements diff --git a/bugsnag/__init__.py b/bugsnag/__init__.py index 925ae5b1..dbd0c625 100644 --- a/bugsnag/__init__.py +++ b/bugsnag/__init__.py @@ -18,7 +18,7 @@ clear_feature_flag, clear_feature_flags, aws_lambda_handler) -__version__ = '4.9.1' +__version__ = '4.9.2' __all__ = ('Client', 'Event', 'Configuration', 'RequestConfiguration', 'configuration', 'configure', 'configure_request', diff --git a/bugsnag/notifier.py b/bugsnag/notifier.py index 709088ad..a699004d 100644 --- a/bugsnag/notifier.py +++ b/bugsnag/notifier.py @@ -1,5 +1,5 @@ _NOTIFIER_INFORMATION = { 'name': 'Python Bugsnag Notifier', 'url': 'https://github.com/bugsnag/bugsnag-python', - 'version': '4.9.1' + 'version': '4.9.2' } diff --git a/setup.py b/setup.py index be3e9477..ac538529 100755 --- a/setup.py +++ b/setup.py @@ -14,7 +14,7 @@ setup( name='bugsnag', - version='4.9.1', + version='4.9.2', description='Automatic error monitoring for django, flask, etc.', long_description=__doc__, author='Simon Maynard',