[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@hyperdx/cli@0.8.1

Patch Changes

• d7df729: chore: GitHub links (changelog, support, package metadata) now point at ClickHouse/ClickStack, and docker-compose.yml pulls the app image as clickhouse/clickstack
• e2754d2: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row
  details and drill-down work on FIPS-enabled ClickHouse deployments

@hyperdx/api@2.44.0

Minor Changes

• cd0e9ed: feat: add optional titleEmoji webhook option; false removes the emoji prefix from notification titles sent through that webhook

• 5b0d074: feat: self-instrument with @clickhouse/clickstack-node and
  @clickhouse/clickstack-browser instead of @hyperdx/node-opentelemetry and
  @hyperdx/browser

  HyperDX's own telemetry changes shape. HTTP spans use the stable semantic
  convention keys (http.request.method, http.response.status_code,
  url.full). pino records come from the @opentelemetry/instrumentation-pino
  scope with real severity numbers instead of the node-logger scope with
  severity number 0. Console capture covers every console call in the API, and
  browser console output is recorded as log records instead of spans. Uncaught
  exceptions are recorded as FATAL log records, and API errors as an exception
  event on the Express span instead of a separate error span.

  Browser telemetry records the user as user.id, user.email and user.name
  instead of userEmail and userName, keeps the team name as teamName, and no
  longer records a user navigated action. Browser fetch and XHR spans no longer
  record request and response headers or bodies. Browser sessions restart once
  after the upgrade. The per-signal browser endpoints and
  NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES work as before. Browser traces and logs
  are now sent gzip-compressed every 5 seconds. If the browser sends to a
  collector other than ClickStack's, its CORS allowed_headers must be "*" or
  include content-type and content-encoding (and authorization), and a proxy
  in front of it must forward Content-Encoding unchanged.

  The Next.js server now sends its own telemetry in production builds too, not
  only under next dev, when HYPERDX_API_KEY or OTEL_EXPORTER_OTLP_HEADERS is
  set. HDX_EXPORTER_ENABLED=false turns it off along with browser telemetry. It
  reports under its own service name, the configured one plus -next
  (hdx-oss-app-next in the docker-compose app service and when no name is
  set), so its spans stay apart from the API's and the browser's. The HyperDX
  images now default OTEL_SERVICE_NAME to hdx-oss-app. Each /api request
  adds Next.js server spans for the proxy hop. Requests for build and public/
  assets, such as /_next/static/*, /__ENV.js and /pyodide/*, are not traced.

  HYPERDX_API_KEY still enables self-instrumentation. Without
  OTEL_EXPORTER_OTLP_ENDPOINT, server-side self-telemetry now goes to
  http://localhost:4318 instead of https://in-otel.hyperdx.io, so set the
  endpoint explicitly. HDX_NODE_* variables are no longer read. For request
  headers and bodies set OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_* and
  CLICKSTACK_CAPTURE_HTTP_BODY.

• 349fc21: feat(mcp): add clickstack_describe_table to list the tables in a database and describe a table that is not a registered source (columns, keys, engine, skipping indices, approximate size, optional row sample)

• 0eec5e1: feat: Describe PromQL sources in MCP and hide them when PromQL is disabled

  clickstack_describe_source now returns the label names and metric names of a PromQL source, from either a ClickHouse TimeSeries table or a Prometheus-compatible endpoint, instead of a column schema. clickstack_list_sources and clickstack_describe_source show which backend a PromQL source uses, and for TimeSeries tables explain how to read them with clickstack_sql. Prometheus endpoint sources no longer show their placeholder table. When ENABLE_PROMQL is off, MCP hides PromQL sources from listing, describing and deleting, and clickstack_save_source no longer accepts kind: "promql".

• 95fa364: feat(mcp): support setting a dashboard's savedFilterValues via the MCP dashboard tools

• c792850: feat: filter the v2 list alerts endpoint by tag, search, source and state

Patch Changes

• 0453aa1: fix: A grouped alert whose group vanishes from the data now resolves with the group's values in {{attributes.*}} (alert title and message) and {{var.*}} (webhook body)

• 5b0d074: fix: let browsers cache the collector's CORS preflights for 10 minutes

  The OTLP receiver now answers preflights with Access-Control-Max-Age: 600.
  Without it, browsers cached a preflight for only 5 seconds, which is how often
  the browser SDK exports, so about half of its requests were preflights.

• 769c0de: fix: ignore team and createdBy in dashboard and saved search PATCH bodies so they can't be moved to another team or have their owner rewritten

• 5584f84: fix: make clickstack_event_patterns drill-down snippets executable

  Each pattern's whereSnippet is now a SQL predicate (whereLanguage: "sql") that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to clickstack_search returns the pattern's events. Before, a template like Sending <*> rows produced Body:"Sending rows", which matched nothing, and map fields produced Lucene that failed to parse. bodyExpression now also accepts JSONExtractString(<column>, '<key>', ...) to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries.

  clickstack_event_patterns, clickstack_emerging_signals and dashboard event-pattern tiles now apply the log source's tableFilterExpression, so their counts can drop for sources that set one. minePatterns now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit.

• 253a690: docs: MCP tool descriptions and the query guide now recommend the quoted Lucene
  form field:"value" for exact matches, and bare terms or phrases for log body
  text, so agents keep the primary key and the text index

• 917c9ca: feat: MCP dashboard tools read and write PromQL tiles and PROMETHEUS_LABEL filters when PromQL is enabled, and hide but keep them when it is disabled

• d08b2fa: feat(mcp): clickstack_sql accepts a queries array to run up to 10
  independent queries in parallel under a shared 60s deadline. Each query reports
  its own ok/error/timeout status, so one failing query does not fail the
  others. Single-query calls with sql behave as before.

• a13c80e: feat(mcp): clickstack_table takes optional limit and having, and orders grouped results by the first select item, descending, when no orderBy is given

• 0262822: fix: MCP tool responses that are over the size budget now shorten long strings with a …(+N chars) suffix instead of replacing them, say what was trimmed in trimNotes, and clickstack_event_patterns / clickstack_emerging_signals drop samples and shorten long patterns before cutting whole patterns, so the requested topN survives when it can

• 442d6df: fix: refresh cached table columns after 5 minutes

  The shared metadata cache kept each table's DESCRIBE result for the life of
  the process, so the API did not see columns added with ALTER TABLE, such as
  new MATERIALIZED columns, until it restarted. Cached columns now expire after 5
  minutes. Other cached metadata is unchanged.

• 0eec5e1: fix: Authenticate to Prometheus connections whose host includes credentials

  A Prometheus connection host such as http://user:pass@prometheus:9090 made every PromQL query fail with "Failed to reach Prometheus", because fetch rejects URLs that carry credentials. The credentials are now sent as a Basic auth header.

• 0a5237e: fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL
  tiles, and builder tiles with unsupported display types), and drop them when a
  dashboard is saved

• b7b4d95: fix: update systeminformation to 5.33.19

  The root resolutions pin let the lockfile keep systeminformation 5.30.7, which
  has known command injection advisories, including two high-severity ones in
  networkInterfaces() on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The
  API installs it through @opentelemetry/instrumentation-host-metrics, which
  asks for ^5.31.6, but the old pin held it at 5.30.7. The pin now starts at
  5.33.19, the newest 5.x release, which fixes all of them.

• Updated dependencies [cd0e9ed]

• Updated dependencies [e2754d2]

• Updated dependencies [22f824c]

• Updated dependencies [d0dd06f]

• Updated dependencies [5584f84]

• Updated dependencies [41b2b74]

• Updated dependencies [442d6df]

• Updated dependencies [0a5237e]

• Updated dependencies [78143c8]

  • @hyperdx/common-utils@0.34.0

@hyperdx/app@2.44.0

Minor Changes

• cd0e9ed: feat: add optional titleEmoji webhook option; false removes the emoji prefix from notification titles sent through that webhook

• 5b0d074: feat: self-instrument with @clickhouse/clickstack-node and
  @clickhouse/clickstack-browser instead of @hyperdx/node-opentelemetry and
  @hyperdx/browser

  HyperDX's own telemetry changes shape. HTTP spans use the stable semantic
  convention keys (http.request.method, http.response.status_code,
  url.full). pino records come from the @opentelemetry/instrumentation-pino
  scope with real severity numbers instead of the node-logger scope with
  severity number 0. Console capture covers every console call in the API, and
  browser console output is recorded as log records instead of spans. Uncaught
  exceptions are recorded as FATAL log records, and API errors as an exception
  event on the Express span instead of a separate error span.

  Browser telemetry records the user as user.id, user.email and user.name
  instead of userEmail and userName, keeps the team name as teamName, and no
  longer records a user navigated action. Browser fetch and XHR spans no longer
  record request and response headers or bodies. Browser sessions restart once
  after the upgrade. The per-signal browser endpoints and
  NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES work as before. Browser traces and logs
  are now sent gzip-compressed every 5 seconds. If the browser sends to a
  collector other than ClickStack's, its CORS allowed_headers must be "*" or
  include content-type and content-encoding (and authorization), and a proxy
  in front of it must forward Content-Encoding unchanged.

  The Next.js server now sends its own telemetry in production builds too, not
  only under next dev, when HYPERDX_API_KEY or OTEL_EXPORTER_OTLP_HEADERS is
  set. HDX_EXPORTER_ENABLED=false turns it off along with browser telemetry. It
  reports under its own service name, the configured one plus -next
  (hdx-oss-app-next in the docker-compose app service and when no name is
  set), so its spans stay apart from the API's and the browser's. The HyperDX
  images now default OTEL_SERVICE_NAME to hdx-oss-app. Each /api request
  adds Next.js server spans for the proxy hop. Requests for build and public/
  assets, such as /_next/static/*, /__ENV.js and /pyodide/*, are not traced.

  HYPERDX_API_KEY still enables self-instrumentation. Without
  OTEL_EXPORTER_OTLP_ENDPOINT, server-side self-telemetry now goes to
  http://localhost:4318 instead of https://in-otel.hyperdx.io, so set the
  endpoint explicitly. HDX_NODE_* variables are no longer read. For request
  headers and bodies set OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_* and
  CLICKSTACK_CAPTURE_HTTP_BODY.

• af17e8f: The app always uses ClickStack branding. Brand selection, the HyperDX palette, and the font picker are removed. Light, dark, and system color mode stay in Preferences.

• dd8c2e4: feat: Pick a time zone for the search and dashboard pages from the time picker, overriding the time zone in User Preferences. The picker shows the zone it uses, and the choice is kept in the URL and in links from charts and tables

Patch Changes

• 7de661b: feat: Row side panel summarizes clicks, navigations and console messages from OpenTelemetry browser SDKs, and navigation rows no longer show an HTTP Request section

• ab36d4e: feat: publish the HyperDX image as clickhouse/clickstack alongside
  hyperdx/hyperdx, matching the other clickhouse/clickstack-* images. Release
  workflows no longer log into ghcr.io, which received no pushes.

• f56d4ad: fix(app): use the ClickStack hexagon and bolt mark in the logo, the collapsed nav, and the favicon.

• d7df729: chore: GitHub links (changelog, support, package metadata) now point at ClickHouse/ClickStack, and docker-compose.yml pulls the app image as clickhouse/clickstack

• f56d4ad: fix(app): open the full nav over the page on compact viewports. On narrow screens the sidebar toggle now opens the full nav as an overlay instead of doing nothing.

• 513b237: fix: start the trace waterfall higher in the side panel

  Trace spans no longer repeat their name in a box under the panel title, or the
  service as a chip next to the metadata row that already shows it. The
  "⌘/Ctrl + scroll to zoom" hint moves into the timeline's top-left corner
  instead of taking its own row. Long span names that the title truncates keep
  the box. Log panels keep their body box and service chip.

• e2754d2: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row
  details and drill-down work on FIPS-enabled ClickHouse deployments

• 5abf27e: Saving a search no longer reloads the page: the new saved search is opened with
  a client-side navigation, which also fixes the 404 this caused on the static
  ClickStack build.

• 04f55d1: feat: Exception panel parses JavaScript stack traces from OpenTelemetry SDKs into frames, with a section per Caused by: error

• d0dd06f: fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace
  waterfall

• 41b2b74: feat: fall back to server MergeTree settings to detect persisted _block_number and _block_offset columns when the table's CREATE query omits them

• 442d6df: fix: refresh cached table columns after 5 minutes

  The shared metadata cache kept each table's DESCRIBE result for the life of
  the process, so the API did not see columns added with ALTER TABLE, such as
  new MATERIALIZED columns, until it restarted. Cached columns now expire after 5
  minutes. Other cached metadata is unchanged.

• 9df8b8d: fix: bump next to 16.4.3 so builds no longer fail intermittently when Google Fonts returns extensionless font URLs

• ec0db7a: fix: Creating an alert from the search page asks for one name, not two. An unsaved search is named once in the alert modal's header and the alert inherits that name and its tags; on a saved search the alert's own name field is labelled "Alert name" and shows the inherited name as its placeholder instead of pre-filling a duplicate.

• 86cd38b: fix: only use the key-only row details lookup when the table persists both _block_number and _block_offset. A lone block column (e.g. a server-wide enable_block_offset_column) is not unique with a second-precision primary key and could open the wrong row; it is now only added as a tiebreaker to the full-row lookup.

• 3a412e4: fix: run the row details query once when opening a row

  The side panel ran the same SELECT * row query twice: once for the panel, and
  again when its Overview or Column Values tab mounted. A row that was found is
  now reused from the cache, so the tab and later tab switches do not query it
  again. A different row or source still runs the query, and a row that was not
  found is looked up again.

• 78143c8: feat: on ClickHouse Cloud, read system.shared_merge_tree_settings when detecting _block_number and _block_offset columns, falling back to system.merge_tree_settings per key

• 4e93ae5: fix(app): render the ClickStack name as text in the expanded sidebar, 8px from the logo symbol.

• af75b2b: feat: Trace waterfall shows OpenTelemetry browser SDK request timings as dots on fetch and XHR spans, and the click that triggered a browser trace

• 4e93ae5: fix(app): use the new favicon set, including an SVG, in the browser tab, bookmarks, and touch icon.

• Updated dependencies [0453aa1]

• Updated dependencies [cd0e9ed]

• Updated dependencies [5b0d074]

• Updated dependencies [5b0d074]

• Updated dependencies [769c0de]

• Updated dependencies [e2754d2]

• Updated dependencies [22f824c]

• Updated dependencies [d0dd06f]

• Updated dependencies [349fc21]

• Updated dependencies [5584f84]

• Updated dependencies [253a690]

• Updated dependencies [0eec5e1]

• Updated dependencies [917c9ca]

• Updated dependencies [95fa364]

• Updated dependencies [d08b2fa]

• Updated dependencies [a13c80e]

• Updated dependencies [0262822]

• Updated dependencies [41b2b74]

• Updated dependencies [442d6df]

• Updated dependencies [0eec5e1]

• Updated dependencies [0a5237e]

• Updated dependencies [78143c8]

• Updated dependencies [b7b4d95]

• Updated dependencies [c792850]

  • @hyperdx/api@2.44.0
  • @hyperdx/common-utils@0.34.0

@hyperdx/common-utils@0.34.0

Minor Changes

• cd0e9ed: feat: add optional titleEmoji webhook option; false removes the emoji prefix from notification titles sent through that webhook

Patch Changes

• e2754d2: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row
  details and drill-down work on FIPS-enabled ClickHouse deployments

• 22f824c: fix: keep JSON path segments with special characters quoted in row detail lookups

• d0dd06f: fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace
  waterfall

• 5584f84: fix: make clickstack_event_patterns drill-down snippets executable

  Each pattern's whereSnippet is now a SQL predicate (whereLanguage: "sql") that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to clickstack_search returns the pattern's events. Before, a template like Sending <*> rows produced Body:"Sending rows", which matched nothing, and map fields produced Lucene that failed to parse. bodyExpression now also accepts JSONExtractString(<column>, '<key>', ...) to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries.

  clickstack_event_patterns, clickstack_emerging_signals and dashboard event-pattern tiles now apply the log source's tableFilterExpression, so their counts can drop for sources that set one. minePatterns now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit.

• 41b2b74: feat: fall back to server MergeTree settings to detect persisted _block_number and _block_offset columns when the table's CREATE query omits them

• 442d6df: fix: refresh cached table columns after 5 minutes

  The shared metadata cache kept each table's DESCRIBE result for the life of
  the process, so the API did not see columns added with ALTER TABLE, such as
  new MATERIALIZED columns, until it restarted. Cached columns now expire after 5
  minutes. Other cached metadata is unchanged.

• 0a5237e: fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL
  tiles, and builder tiles with unsupported display types), and drop them when a
  dashboard is saved

• 78143c8: feat: on ClickHouse Cloud, read system.shared_merge_tree_settings when detecting _block_number and _block_offset columns, falling back to system.merge_tree_settings per key

@hyperdx/otel-collector@2.44.0

Patch Changes

• 5b0d074: fix: let browsers cache the collector's CORS preflights for 10 minutes

  The OTLP receiver now answers preflights with Access-Control-Max-Age: 600.
  Without it, browsers cached a preflight for only 5 seconds, which is how often
  the browser SDK exports, so about half of its requests were preflights.

• 8384fe6: perf: compress the seed schemas with ZSTD(3) instead of ZSTD(1)

  The seed schemas pinned ZSTD(1) on almost every column. Level 3 gives a better
  compression ratio at a small insert-time CPU cost, without affecting reads, and
  it is the default codec of ClickHouse since 26.9. It is pinned explicitly so
  that older ClickHouse versions, whose default is LZ4, get it too. Delta
  codecs drop their byte-size argument, which ClickHouse infers from the column
  type. Only newly created tables are affected; existing tables keep their codecs.

• 7021810: feat: session ID columns, session.id from rum.sessionId, severity text

  The hyperdx_sessions seed adds materialized rum.sessionId and session.id
  columns with skip indexes, and the otel_logs seed adds a materialized
  session.id column with a skip index, so session queries no longer read the
  attribute maps. Only newly created tables get them; existing tables need an
  ALTER TABLE ... ADD COLUMN to benefit.

  Spans, logs and session replay events from older @hyperdx/browser SDKs, which
  carry the session id only in the rum.sessionId resource attribute, now also
  get the OpenTelemetry session.id attribute. An existing session.id is never
  overwritten and rum.sessionId is kept. If you override pipeline processors:
  lists in CUSTOM_OTELCOL_CONFIG_FILE, add transform/session_id to keep this.

  Logs that carry a severity number but no severity text, such as those from the
  new browser SDK, now get the matching level text (info, error, ...) instead
  of an empty level. Severity text set by the producer is never overwritten.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clickstack-oss	Ready	Preview	Nov 7, 2026 3:22am UTC
clickstack-storybook	Ready	Preview	Nov 7, 2026 3:22am UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
hyperdx-oss	Ignored	Preview	Nov 7, 2026 3:22am UTC
hyperdx-storybook	Ignored	Preview	Nov 7, 2026 3:22am UTC