npm / @sentry/cli
@sentry/cli
What changed in @sentry/cli 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
5 breaking5 security6 new APIs and options2 performance1 behavior and defaults1 tooling8 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@sentry/cli 328 changes
Breaking changes 5
The URL and non-embedded auth token are no longer combined when they come from different configuration files; configure them in the same file or through CLI arguments and environment variables.
The experimental flag was removed from build commands.
The experimental flag was removed from snapshots commands.
Events no longer send environment variables.
Rejects snapshot uploads with a PR number but no base SHA because comparisons require a base reference.
Security 5
Xcode Info.plist preprocessing is disabled by default during release inference; use this option only for trusted projects that require preprocessing.
TLS verification is disabled only when this setting is
false, case-insensitively.Generated arguments, including paths, tags, release names, and the CLI path, are shell-escaped.
Maintains restrictive file permissions when updating existing config files.
Verifies the downloaded binary checksum before replacing the current executable.
New APIs and options 6
Adds PE DWARF companion support.
Adds a command for locally comparing directories of PNG snapshot images using odiff.
Adds a command for downloading baseline snapshot images from Sentry.
Adds a flag for detecting image removals and renames in selective builds.
Adds a flag for detecting image removals and renames in selective builds.
Adds Windows ARM64 PE unwind support.
Performance 2
The preprod snapshot manifest is compressed with zstd.
Skips uploading images that already exist in objectstore by batch-checking with HEAD requests first.
Behavior and default changes 1
Snapshot images are uploaded to the objectstore usecase chosen by the server instead of a hardcoded one.
Tooling 1
IPA uploads now support dSYM files.
Fixes and other changes 8
Snapshot builds are created for selective uploads with no affected images when a complete filename manifest is provided.
Debug IDs are now generated by hashing both the JS and sourcemap bytes, preventing collisions between distinct JS files with identical sourcemaps.
Uses the new archive endpoint, triggering the archive build and polling until it is ready before downloading.
Shows a clear project-renamed error when uploading to a renamed project slug instead of a cryptic JSON parse failure.
The update nagger now shows when a newer version is available.
Respects this environment variable when configuring TLS certificate authorities.
Improves the error message shown when the organization slug is missing from configuration.
Respects this environment variable when configuring TLS certificate authorities.