[github-actions]

Sentry self-hosted 26.8.0

Updates the chart app version from 26.7.2 to 26.8.0.

Manual compatibility review

• Review all upstream release notes below.
• Review upstream configuration/default changes before merging.
• Confirm database migrations and any required manual steps.
• Confirm the chart’s version-gated templates remain correct.

Explicit upgrade-risk signals

• 26.8.0: migration, removed

Sensitive upstream files changed

• .env
• docker-compose.yml
• install.sh
• install/migrate-seaweedfs-kek.sh
• install/setup-custom-ca-certificate.sh
• taskbroker/config.yml

Upstream release notes

26.8.0

TL;DR: Patch release fixing a critical SAML SSO security vulnerability. Upgrade promptly.

Warning

⚠️ Security Advisory: This release patches GHSA-rrcx-889m-5jj5 — unauthorized organization member addition or identity linking. This is a recommended upgrade.

[!NOTE]
Some real housekeeping this release: 7 containers gone, Redis is now Valkey, and Kafka retention got a lot leaner. If you're running a docker-compose.override.yml, read the first section before you upgrade, the container removals can bite you there.

Removed 7 containers related to generic metrics

We stripped out 7 containers tied to generic metrics — the stuff that used to power web frontend metrics like LCP and TTFB. This data already made the move to span metrics a while back and has been living in the eap_items table on ClickHouse ever since, so these containers were just dead weight. No functional change on your end, just fewer things running and less to worry about. A happy day for self-hosters.

As noted above, ingest-replay-recordings falls into this same cleanup — it's now handled as part of taskworker rather than as its own container. Same job, different home. Again: if you've got a docker-compose.override.yml, double check it against this removal before you upgrade.

Switched Redis to Valkey

Worth restating our general policy here since it comes up: we only touch database dependencies when SaaS does. This time, that means migrating from Redis to Valkey. The main draw is Valkey's multithreading support — in practice that should translate to faster Redis-protocol queries without you having to do anything differently on your end.

Lessened Kafka log retention hours

We dropped KAFKA_LOG_RETENTION_HOURS from 24 down to 3. Honestly, we're not entirely sure why it was set to 24 in the first place, that value really only earns its keep if your processing pipeline is slow. Most setups process fast enough that 24 hours of retention was just burning disk space for no benefit. Three hours should be plenty of buffer while giving you back a meaningful chunk of storage.

One thing that snuck in late (honestly, last minute): we added --auto-offset-reset=earliest --no-strict-offset-reset flags to the Sentry consumers. This was necessary to stop consumers from hitting constant Kafka Offset Out Of Range errors now that retention is so much shorter —without it, a consumer that falls behind could find its offset has already aged out.

Notable updates

• We finally landed a fix for the high CPU consumption issue on the Snuba API container that's been open since 26.6.0 back in July 2026. Long overdue, but it's done.
• Since migrating off weed server to weed mini, some of you have reported SSE-S3 Key Manager failed to initialize errors. We now run a migration from the legacy KEK before weed mini starts up, which should resolve it. This ships alongside a version bump to a newer SeaweedFS release (PR #4461).

Full diff: getsentry/self-hosted@26.7.2...26.8.0

---

As always, if you hit snags upgrading or just want to talk through your setup, swing by our Discord — we're always happy to help and chat.

New Features ✨

Tasks

• Increase kafka_session_timeout_ms in taskbroker by @aminvakil in #4464
• Port ingest replays to taskbroker by @lvthanh03 in #4448

Other

• Add --no-strict-offset-reset flags to sentry consumers by @aldy505 in #4473
• Use valkey instead of redis by @aminvakil in #4438

Bug Fixes 🐛

• (ci) Make integration tests on Linux arm64 not flaky by @aldy505 in #4313
• (seaweedfs) Migrate legacy KEK before starting weed mini by @aminvakil in #4461

Internal Changes 🔧

Deps

• Bump j178/prek-action from 2.0.6 to 3.0.0 by @dependabot in #4445
• Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #4432
• Bump urllib3 from 2.6.3 to 2.7.0 by @dependabot in #4429

Other

• (consumer) Remove unused billing metrics consumer by @Dav1dde in #4468
• Ignore kafka > 7.6 by @aminvakil in #4470
• Ignore multiple images major versions bump by @aminvakil in #4466
• Ignore kafka major versions bump by @aminvakil in #4462
• Remove unused generic metrics s/g/d compose services by @sentry-junior in #4467
• Ignore postgres major versions bump by @aminvakil in #4457
• Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup by @oioki in #4451
• Decrease Kafka log retention hours by @aldy505 in #4442
• Remove disabled changelog-preview workflow by @oioki in #4447

Full changelog: https://github.com/getsentry/self-hosted/releases/tag/26.8.0

This PR was created automatically. It never auto-merges.