Securitysshole: password bypass in Alpine’s OpenSSH

@sentry/node@11.12.0

Wait — 11.2.0 is the safer choice for now.

Published 37 h ago; most regressions surface within 72 h.

Why this verdict

  • Published 37 h ago; most regressions surface within 72 h.Evidence

Confidence 100% · algorithm v1 · computed 2026-11-12. How verdicts work

Supply chain and security

Malware reports
None known (OSV)
Known advisories
None known (OSV)
License
MIT
Install scripts
None
Build provenance
No provenance
Weekly downloads
41,603

Compatibility

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

3 issues mention this version in getsentry/sentry-javascript so far (14-day window still open). See them on GitHub

Check the official release notes below for behaviour changes before merging.

Release notes

Read the Sentry changelog on Changes.Watch or the package page on npm for this version’s features and fixes.

New in this release

  • The bundler plugins now automatically enable hidden source maps and remove them after upload.“The Sentry Rollup, Vite, webpack and esbuild plugins now turn on hidden source maps when your bundler has no source maps enabled and the plugin can upload them.”
  • Cloudflare Queue consumers can now propagate tracing context through messages.“Cloudflare Queue consumers can now link to the traces of the producers that sent the messages.”
  • serveTunnelIntegration() now answers tunnel requests directly in the runtime without requiring a framework integration or route handler.“`serveTunnelIntegration()` now answers tunnel requests before they reach your app, in Node.js, Bun, Deno, Cloudflare Workers and AWS Lambda.”

AI-extracted from the official release notes and checked against the quoted text. Read the source

Deprecations and deadlines

The maintainer has not deprecated this version on npm.

Deprecations announced in this release

  • tunnelRoute has been deprecated in tanstackstart-react.“feat(tanstackstart-react): Deprecate `tunnelRoute` ([#26225](https://github.com/getsentry/sentry-javascript/pull/26225))”

AI-extracted from the official release notes and checked against the quoted text. Read the source

Did upgrading to 11.12.0 work for you?

Results appear once three developers have voted.

More @sentry/node verdicts