Skip to content

add comment

47f5a6b
Select commit
Loading
Failed to load commit list.
Merged

feat(sqlalchemy): Support span streaming #6132

add comment
47f5a6b
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden: find-bugs completed Apr 28, 2026 in 1m 8s

2 issues

find-bugs: Found 2 issues (1 medium, 1 low)

Medium

Streaming SQL span drops db.params, db.paramstyle, db.executemany, and db.cursor attributes - `sentry_sdk/tracing_utils.py:213-220`

In the streaming branch, the data dict (db.params, db.paramstyle, db.executemany, db.cursor) is built but never attached to the span — only sentry.origin and sentry.op are set as attributes. The legacy branch (else) correctly applies them via span.set_data(k, v). As a consequence, when trace_lifecycle == 'stream' is enabled, SQL spans lose all parameter/cursor/executemany diagnostic information that users rely on for debugging, while the same instrumentation works on the non-streaming path. This is a behavioral regression that silently degrades observability on the streaming code path.

Low

`` fallback is unreachable as written but masks empty-string queries - `sentry_sdk/tracing_utils.py:214`

query = _format_sql(cursor, query) returns real_sql or to_string(sql) (tracing_utils.py:513). to_string typically does not return None for non-None input, and even if sql is None, to_string(None) would yield the string 'None' rather than None. Therefore the "<unknown SQL query>" if query is None else query guard is essentially dead code for the documented inputs. More importantly, an empty string query ("") — a plausible degenerate input — would still be used as the span name instead of the fallback because the check is is None rather than a truthiness check, leading to spans named with an empty string.


Duration: 1m 4s · Tokens: 551.1k in / 7.3k out · Cost: $2.98 (+merge: $0.00)

Annotations

Check warning on line 220 in sentry_sdk/tracing_utils.py

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

Streaming SQL span drops db.params, db.paramstyle, db.executemany, and db.cursor attributes

In the streaming branch, the `data` dict (db.params, db.paramstyle, db.executemany, db.cursor) is built but never attached to the span — only `sentry.origin` and `sentry.op` are set as attributes. The legacy branch (else) correctly applies them via `span.set_data(k, v)`. As a consequence, when `trace_lifecycle == 'stream'` is enabled, SQL spans lose all parameter/cursor/executemany diagnostic information that users rely on for debugging, while the same instrumentation works on the non-streaming path. This is a behavioral regression that silently degrades observability on the streaming code path.