From df046ead3afd7da9292f68d3c79178cd2a5d73cd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 7 Nov 2026 03:19:38 +0000 Subject: [PATCH 1/2] chore(release): bump HyperDX app/package versions --- .../alert-resolve-vanished-group-values.md | 5 - .changeset/alert-title-emoji-toggle.md | 7 - .changeset/browser-event-row-summary.md | 5 - .changeset/clickstack-app-image.md | 7 - .changeset/clickstack-hexagon-mark.md | 5 - .changeset/clickstack-repo-links.md | 6 - .changeset/clickstack-sdks.md | 45 ------- .changeset/collector-cors-max-age.md | 10 -- .changeset/compact-nav-overlay.md | 5 - .changeset/compact-trace-side-panel.md | 11 -- .changeset/dashboard-patch-team-immutable.md | 5 - .changeset/default-compression-codec.md | 12 -- .changeset/fips-row-lookup-sha256.md | 8 -- .../fix-at-prefixed-json-key-row-details.md | 5 - ...fix-saved-search-client-side-navigation.md | 7 - .../javascript-exception-stack-frames.md | 5 - .changeset/legacy-span-error-status.md | 7 - .changeset/mcp-describe-table.md | 5 - .changeset/mcp-event-patterns-drilldown.md | 10 -- .changeset/mcp-lucene-exact-match.md | 7 - .changeset/mcp-promql-sources.md | 7 - .changeset/mcp-promql-tiles.md | 5 - .changeset/mcp-saved-filter-values.md | 5 - .changeset/mcp-sql-batch-queries.md | 8 -- .changeset/mcp-table-limit-having-order.md | 5 - .changeset/mcp-trim-shorten-reductions.md | 5 - .../merge-tree-settings-block-columns.md | 6 - .changeset/metadata-columns-cache-ttl.md | 12 -- .changeset/next-font-extensionless-urls.md | 5 - .../one-name-when-alerting-a-new-search.md | 5 - .changeset/prometheus-proxy-basic-auth.md | 7 - .changeset/reject-promql-tile-alerts.md | 8 -- .changeset/remove-brand-themes.md | 5 - .../row-lookup-requires-both-block-columns.md | 5 - .changeset/row-side-panel-single-fetch.md | 11 -- .../session-id-columns-severity-text.md | 21 --- .changeset/shared-merge-tree-settings.md | 6 - .changeset/sidebar-wordmark-text.md | 5 - .../systeminformation-command-injection.md | 12 -- .changeset/time-zone-override.md | 5 - .changeset/trace-waterfall-browser-events.md | 5 - .changeset/update-favicon.md | 5 - .changeset/v2-alerts-list-filters.md | 5 - .env | 4 +- packages/api/CHANGELOG.md | 114 ++++++++++++++++ packages/api/package.json | 4 +- packages/app/CHANGELOG.md | 124 ++++++++++++++++++ packages/app/package.json | 4 +- packages/cli/CHANGELOG.md | 8 ++ packages/cli/package.json | 4 +- packages/common-utils/CHANGELOG.md | 32 +++++ packages/common-utils/package.json | 2 +- packages/otel-collector/CHANGELOG.md | 37 ++++++ packages/otel-collector/package.json | 2 +- yarn.lock | 8 +- 55 files changed, 329 insertions(+), 354 deletions(-) delete mode 100644 .changeset/alert-resolve-vanished-group-values.md delete mode 100644 .changeset/alert-title-emoji-toggle.md delete mode 100644 .changeset/browser-event-row-summary.md delete mode 100644 .changeset/clickstack-app-image.md delete mode 100644 .changeset/clickstack-hexagon-mark.md delete mode 100644 .changeset/clickstack-repo-links.md delete mode 100644 .changeset/clickstack-sdks.md delete mode 100644 .changeset/collector-cors-max-age.md delete mode 100644 .changeset/compact-nav-overlay.md delete mode 100644 .changeset/compact-trace-side-panel.md delete mode 100644 .changeset/dashboard-patch-team-immutable.md delete mode 100644 .changeset/default-compression-codec.md delete mode 100644 .changeset/fips-row-lookup-sha256.md delete mode 100644 .changeset/fix-at-prefixed-json-key-row-details.md delete mode 100644 .changeset/fix-saved-search-client-side-navigation.md delete mode 100644 .changeset/javascript-exception-stack-frames.md delete mode 100644 .changeset/legacy-span-error-status.md delete mode 100644 .changeset/mcp-describe-table.md delete mode 100644 .changeset/mcp-event-patterns-drilldown.md delete mode 100644 .changeset/mcp-lucene-exact-match.md delete mode 100644 .changeset/mcp-promql-sources.md delete mode 100644 .changeset/mcp-promql-tiles.md delete mode 100644 .changeset/mcp-saved-filter-values.md delete mode 100644 .changeset/mcp-sql-batch-queries.md delete mode 100644 .changeset/mcp-table-limit-having-order.md delete mode 100644 .changeset/mcp-trim-shorten-reductions.md delete mode 100644 .changeset/merge-tree-settings-block-columns.md delete mode 100644 .changeset/metadata-columns-cache-ttl.md delete mode 100644 .changeset/next-font-extensionless-urls.md delete mode 100644 .changeset/one-name-when-alerting-a-new-search.md delete mode 100644 .changeset/prometheus-proxy-basic-auth.md delete mode 100644 .changeset/reject-promql-tile-alerts.md delete mode 100644 .changeset/remove-brand-themes.md delete mode 100644 .changeset/row-lookup-requires-both-block-columns.md delete mode 100644 .changeset/row-side-panel-single-fetch.md delete mode 100644 .changeset/session-id-columns-severity-text.md delete mode 100644 .changeset/shared-merge-tree-settings.md delete mode 100644 .changeset/sidebar-wordmark-text.md delete mode 100644 .changeset/systeminformation-command-injection.md delete mode 100644 .changeset/time-zone-override.md delete mode 100644 .changeset/trace-waterfall-browser-events.md delete mode 100644 .changeset/update-favicon.md delete mode 100644 .changeset/v2-alerts-list-filters.md diff --git a/.changeset/alert-resolve-vanished-group-values.md b/.changeset/alert-resolve-vanished-group-values.md deleted file mode 100644 index fd926ea135..0000000000 --- a/.changeset/alert-resolve-vanished-group-values.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: A grouped alert whose group vanishes from the data now resolves with the group's values in `{{attributes.*}}` (alert title and message) and `{{var.*}}` (webhook body) diff --git a/.changeset/alert-title-emoji-toggle.md b/.changeset/alert-title-emoji-toggle.md deleted file mode 100644 index 86158ae7c7..0000000000 --- a/.changeset/alert-title-emoji-toggle.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': minor -'@hyperdx/app': minor -'@hyperdx/common-utils': minor ---- - -feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook diff --git a/.changeset/browser-event-row-summary.md b/.changeset/browser-event-row-summary.md deleted file mode 100644 index 0b4e69838f..0000000000 --- a/.changeset/browser-event-row-summary.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: Row side panel summarizes clicks, navigations and console messages from OpenTelemetry browser SDKs, and navigation rows no longer show an HTTP Request section diff --git a/.changeset/clickstack-app-image.md b/.changeset/clickstack-app-image.md deleted file mode 100644 index aa42011529..0000000000 --- a/.changeset/clickstack-app-image.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: publish the HyperDX image as `clickhouse/clickstack` alongside -`hyperdx/hyperdx`, matching the other `clickhouse/clickstack-*` images. Release -workflows no longer log into ghcr.io, which received no pushes. diff --git a/.changeset/clickstack-hexagon-mark.md b/.changeset/clickstack-hexagon-mark.md deleted file mode 100644 index fa0340f45c..0000000000 --- a/.changeset/clickstack-hexagon-mark.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): use the ClickStack hexagon and bolt mark in the logo, the collapsed nav, and the favicon. diff --git a/.changeset/clickstack-repo-links.md b/.changeset/clickstack-repo-links.md deleted file mode 100644 index 0bea2b4824..0000000000 --- a/.changeset/clickstack-repo-links.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch -'@hyperdx/cli': patch ---- - -chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack` diff --git a/.changeset/clickstack-sdks.md b/.changeset/clickstack-sdks.md deleted file mode 100644 index 16aaacfdb4..0000000000 --- a/.changeset/clickstack-sdks.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -'@hyperdx/api': minor -'@hyperdx/app': minor ---- - -feat: self-instrument with `@clickhouse/clickstack-node` and -`@clickhouse/clickstack-browser` instead of `@hyperdx/node-opentelemetry` and -`@hyperdx/browser` - -HyperDX's own telemetry changes shape. HTTP spans use the stable semantic -convention keys (`http.request.method`, `http.response.status_code`, -`url.full`). pino records come from the `@opentelemetry/instrumentation-pino` -scope with real severity numbers instead of the `node-logger` scope with -severity number 0. Console capture covers every `console` call in the API, and -browser console output is recorded as log records instead of spans. Uncaught -exceptions are recorded as FATAL log records, and API errors as an exception -event on the Express span instead of a separate error span. - -Browser telemetry records the user as `user.id`, `user.email` and `user.name` -instead of `userEmail` and `userName`, keeps the team name as `teamName`, and no -longer records a `user navigated` action. Browser fetch and XHR spans no longer -record request and response headers or bodies. Browser sessions restart once -after the upgrade. The per-signal browser endpoints and -`NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. Browser traces and logs -are now sent gzip-compressed every 5 seconds. If the browser sends to a -collector other than ClickStack's, its CORS `allowed_headers` must be `"*"` or -include `content-type` and `content-encoding` (and `authorization`), and a proxy -in front of it must forward `Content-Encoding` unchanged. - -The Next.js server now sends its own telemetry in production builds too, not -only under `next dev`, when `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` is -set. `HDX_EXPORTER_ENABLED=false` turns it off along with browser telemetry. It -reports under its own service name, the configured one plus `-next` -(`hdx-oss-app-next` in the docker-compose `app` service and when no name is -set), so its spans stay apart from the API's and the browser's. The HyperDX -images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` request -adds Next.js server spans for the proxy hop. Requests for build and `public/` -assets, such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*`, are not traced. - -`HYPERDX_API_KEY` still enables self-instrumentation. Without -`OTEL_EXPORTER_OTLP_ENDPOINT`, server-side self-telemetry now goes to -`http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the -endpoint explicitly. `HDX_NODE_*` variables are no longer read. For request -headers and bodies set `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` and -`CLICKSTACK_CAPTURE_HTTP_BODY`. diff --git a/.changeset/collector-cors-max-age.md b/.changeset/collector-cors-max-age.md deleted file mode 100644 index 264c7d33a6..0000000000 --- a/.changeset/collector-cors-max-age.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/api': patch -'@hyperdx/otel-collector': patch ---- - -fix: let browsers cache the collector's CORS preflights for 10 minutes - -The OTLP receiver now answers preflights with `Access-Control-Max-Age: 600`. -Without it, browsers cached a preflight for only 5 seconds, which is how often -the browser SDK exports, so about half of its requests were preflights. diff --git a/.changeset/compact-nav-overlay.md b/.changeset/compact-nav-overlay.md deleted file mode 100644 index 9524154a6b..0000000000 --- a/.changeset/compact-nav-overlay.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): open the full nav over the page on compact viewports. On narrow screens the sidebar toggle now opens the full nav as an overlay instead of doing nothing. diff --git a/.changeset/compact-trace-side-panel.md b/.changeset/compact-trace-side-panel.md deleted file mode 100644 index feb0782f49..0000000000 --- a/.changeset/compact-trace-side-panel.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: start the trace waterfall higher in the side panel - -Trace spans no longer repeat their name in a box under the panel title, or the -service as a chip next to the metadata row that already shows it. The -"⌘/Ctrl + scroll to zoom" hint moves into the timeline's top-left corner -instead of taking its own row. Long span names that the title truncates keep -the box. Log panels keep their body box and service chip. diff --git a/.changeset/dashboard-patch-team-immutable.md b/.changeset/dashboard-patch-team-immutable.md deleted file mode 100644 index 2b7f5b6ab9..0000000000 --- a/.changeset/dashboard-patch-team-immutable.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: ignore `team` and `createdBy` in dashboard and saved search PATCH bodies so they can't be moved to another team or have their owner rewritten diff --git a/.changeset/default-compression-codec.md b/.changeset/default-compression-codec.md deleted file mode 100644 index c9ebffddaf..0000000000 --- a/.changeset/default-compression-codec.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/otel-collector': patch ---- - -perf: compress the seed schemas with `ZSTD(3)` instead of `ZSTD(1)` - -The seed schemas pinned `ZSTD(1)` on almost every column. Level 3 gives a better -compression ratio at a small insert-time CPU cost, without affecting reads, and -it is the default codec of ClickHouse since 26.9. It is pinned explicitly so -that older ClickHouse versions, whose default is `LZ4`, get it too. `Delta` -codecs drop their byte-size argument, which ClickHouse infers from the column -type. Only newly created tables are affected; existing tables keep their codecs. diff --git a/.changeset/fips-row-lookup-sha256.md b/.changeset/fips-row-lookup-sha256.md deleted file mode 100644 index 5330967a3c..0000000000 --- a/.changeset/fips-row-lookup-sha256.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch -'@hyperdx/cli': patch ---- - -fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row -details and drill-down work on FIPS-enabled ClickHouse deployments diff --git a/.changeset/fix-at-prefixed-json-key-row-details.md b/.changeset/fix-at-prefixed-json-key-row-details.md deleted file mode 100644 index 4f9ea6a094..0000000000 --- a/.changeset/fix-at-prefixed-json-key-row-details.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/common-utils': patch ---- - -fix: keep JSON path segments with special characters quoted in row detail lookups diff --git a/.changeset/fix-saved-search-client-side-navigation.md b/.changeset/fix-saved-search-client-side-navigation.md deleted file mode 100644 index 70d921981c..0000000000 --- a/.changeset/fix-saved-search-client-side-navigation.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -Saving a search no longer reloads the page: the new saved search is opened with -a client-side navigation, which also fixes the 404 this caused on the static -ClickStack build. diff --git a/.changeset/javascript-exception-stack-frames.md b/.changeset/javascript-exception-stack-frames.md deleted file mode 100644 index 48d845b143..0000000000 --- a/.changeset/javascript-exception-stack-frames.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: Exception panel parses JavaScript stack traces from OpenTelemetry SDKs into frames, with a section per `Caused by:` error diff --git a/.changeset/legacy-span-error-status.md b/.changeset/legacy-span-error-status.md deleted file mode 100644 index 783bf8f374..0000000000 --- a/.changeset/legacy-span-error-status.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch ---- - -fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace -waterfall diff --git a/.changeset/mcp-describe-table.md b/.changeset/mcp-describe-table.md deleted file mode 100644 index bd4e022999..0000000000 --- a/.changeset/mcp-describe-table.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat(mcp): add `clickstack_describe_table` to list the tables in a database and describe a table that is not a registered source (columns, keys, engine, skipping indices, approximate size, optional row sample) diff --git a/.changeset/mcp-event-patterns-drilldown.md b/.changeset/mcp-event-patterns-drilldown.md deleted file mode 100644 index edda3830e4..0000000000 --- a/.changeset/mcp-event-patterns-drilldown.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/api': patch -'@hyperdx/common-utils': patch ---- - -fix: make clickstack_event_patterns drill-down snippets executable - -Each pattern's `whereSnippet` is now a SQL predicate (`whereLanguage: "sql"`) that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to `clickstack_search` returns the pattern's events. Before, a template like `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and map fields produced Lucene that failed to parse. `bodyExpression` now also accepts `JSONExtractString(, '', ...)` to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries. - -`clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard event-pattern tiles now apply the log source's `tableFilterExpression`, so their counts can drop for sources that set one. `minePatterns` now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit. diff --git a/.changeset/mcp-lucene-exact-match.md b/.changeset/mcp-lucene-exact-match.md deleted file mode 100644 index 853bb32a84..0000000000 --- a/.changeset/mcp-lucene-exact-match.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -docs: MCP tool descriptions and the query guide now recommend the quoted Lucene -form `field:"value"` for exact matches, and bare terms or phrases for log body -text, so agents keep the primary key and the text index diff --git a/.changeset/mcp-promql-sources.md b/.changeset/mcp-promql-sources.md deleted file mode 100644 index f90a0a187a..0000000000 --- a/.changeset/mcp-promql-sources.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat: Describe PromQL sources in MCP and hide them when PromQL is disabled - -`clickstack_describe_source` now returns the label names and metric names of a PromQL source, from either a ClickHouse TimeSeries table or a Prometheus-compatible endpoint, instead of a column schema. `clickstack_list_sources` and `clickstack_describe_source` show which backend a PromQL source uses, and for TimeSeries tables explain how to read them with `clickstack_sql`. Prometheus endpoint sources no longer show their placeholder table. When `ENABLE_PROMQL` is off, MCP hides PromQL sources from listing, describing and deleting, and `clickstack_save_source` no longer accepts `kind: "promql"`. diff --git a/.changeset/mcp-promql-tiles.md b/.changeset/mcp-promql-tiles.md deleted file mode 100644 index 5f7b54caf6..0000000000 --- a/.changeset/mcp-promql-tiles.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat: MCP dashboard tools read and write PromQL tiles and PROMETHEUS_LABEL filters when PromQL is enabled, and hide but keep them when it is disabled diff --git a/.changeset/mcp-saved-filter-values.md b/.changeset/mcp-saved-filter-values.md deleted file mode 100644 index cb452dd467..0000000000 --- a/.changeset/mcp-saved-filter-values.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat(mcp): support setting a dashboard's `savedFilterValues` via the MCP dashboard tools diff --git a/.changeset/mcp-sql-batch-queries.md b/.changeset/mcp-sql-batch-queries.md deleted file mode 100644 index 266c576978..0000000000 --- a/.changeset/mcp-sql-batch-queries.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat(mcp): `clickstack_sql` accepts a `queries` array to run up to 10 -independent queries in parallel under a shared 60s deadline. Each query reports -its own `ok`/`error`/`timeout` status, so one failing query does not fail the -others. Single-query calls with `sql` behave as before. diff --git a/.changeset/mcp-table-limit-having-order.md b/.changeset/mcp-table-limit-having-order.md deleted file mode 100644 index b03351d002..0000000000 --- a/.changeset/mcp-table-limit-having-order.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat(mcp): `clickstack_table` takes optional `limit` and `having`, and orders grouped results by the first select item, descending, when no `orderBy` is given diff --git a/.changeset/mcp-trim-shorten-reductions.md b/.changeset/mcp-trim-shorten-reductions.md deleted file mode 100644 index 4f319e8280..0000000000 --- a/.changeset/mcp-trim-shorten-reductions.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: MCP tool responses that are over the size budget now shorten long strings with a `…(+N chars)` suffix instead of replacing them, say what was trimmed in `trimNotes`, and `clickstack_event_patterns` / `clickstack_emerging_signals` drop samples and shorten long patterns before cutting whole patterns, so the requested `topN` survives when it can diff --git a/.changeset/merge-tree-settings-block-columns.md b/.changeset/merge-tree-settings-block-columns.md deleted file mode 100644 index 766428e3b6..0000000000 --- a/.changeset/merge-tree-settings-block-columns.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch -'@hyperdx/common-utils': patch ---- - -feat: fall back to server MergeTree settings to detect persisted `_block_number` and `_block_offset` columns when the table's CREATE query omits them diff --git a/.changeset/metadata-columns-cache-ttl.md b/.changeset/metadata-columns-cache-ttl.md deleted file mode 100644 index 4a8b98db6a..0000000000 --- a/.changeset/metadata-columns-cache-ttl.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch -'@hyperdx/api': patch ---- - -fix: refresh cached table columns after 5 minutes - -The shared metadata cache kept each table's `DESCRIBE` result for the life of -the process, so the API did not see columns added with `ALTER TABLE`, such as -new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 -minutes. Other cached metadata is unchanged. diff --git a/.changeset/next-font-extensionless-urls.md b/.changeset/next-font-extensionless-urls.md deleted file mode 100644 index 43ae811e6b..0000000000 --- a/.changeset/next-font-extensionless-urls.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: bump next to 16.4.3 so builds no longer fail intermittently when Google Fonts returns extensionless font URLs diff --git a/.changeset/one-name-when-alerting-a-new-search.md b/.changeset/one-name-when-alerting-a-new-search.md deleted file mode 100644 index 534b9af516..0000000000 --- a/.changeset/one-name-when-alerting-a-new-search.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Creating an alert from the search page asks for one name, not two. An unsaved search is named once in the alert modal's header and the alert inherits that name and its tags; on a saved search the alert's own name field is labelled "Alert name" and shows the inherited name as its placeholder instead of pre-filling a duplicate. diff --git a/.changeset/prometheus-proxy-basic-auth.md b/.changeset/prometheus-proxy-basic-auth.md deleted file mode 100644 index b4ecfc59e0..0000000000 --- a/.changeset/prometheus-proxy-basic-auth.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: Authenticate to Prometheus connections whose host includes credentials - -A Prometheus connection host such as `http://user:pass@prometheus:9090` made every PromQL query fail with "Failed to reach Prometheus", because `fetch` rejects URLs that carry credentials. The credentials are now sent as a Basic auth header. diff --git a/.changeset/reject-promql-tile-alerts.md b/.changeset/reject-promql-tile-alerts.md deleted file mode 100644 index 03c8dc66f9..0000000000 --- a/.changeset/reject-promql-tile-alerts.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -'@hyperdx/api': patch -'@hyperdx/common-utils': patch ---- - -fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL -tiles, and builder tiles with unsupported display types), and drop them when a -dashboard is saved diff --git a/.changeset/remove-brand-themes.md b/.changeset/remove-brand-themes.md deleted file mode 100644 index 1440afbdd5..0000000000 --- a/.changeset/remove-brand-themes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': minor ---- - -The app always uses ClickStack branding. Brand selection, the HyperDX palette, and the font picker are removed. Light, dark, and system color mode stay in Preferences. diff --git a/.changeset/row-lookup-requires-both-block-columns.md b/.changeset/row-lookup-requires-both-block-columns.md deleted file mode 100644 index bf8d093bf8..0000000000 --- a/.changeset/row-lookup-requires-both-block-columns.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: only use the key-only row details lookup when the table persists both `_block_number` and `_block_offset`. A lone block column (e.g. a server-wide `enable_block_offset_column`) is not unique with a second-precision primary key and could open the wrong row; it is now only added as a tiebreaker to the full-row lookup. diff --git a/.changeset/row-side-panel-single-fetch.md b/.changeset/row-side-panel-single-fetch.md deleted file mode 100644 index 581ad0c286..0000000000 --- a/.changeset/row-side-panel-single-fetch.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: run the row details query once when opening a row - -The side panel ran the same `SELECT *` row query twice: once for the panel, and -again when its Overview or Column Values tab mounted. A row that was found is -now reused from the cache, so the tab and later tab switches do not query it -again. A different row or source still runs the query, and a row that was not -found is looked up again. diff --git a/.changeset/session-id-columns-severity-text.md b/.changeset/session-id-columns-severity-text.md deleted file mode 100644 index b92efb96b4..0000000000 --- a/.changeset/session-id-columns-severity-text.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -'@hyperdx/otel-collector': patch ---- - -feat: session ID columns, `session.id` from `rum.sessionId`, severity text - -The `hyperdx_sessions` seed adds materialized `rum.sessionId` and `session.id` -columns with skip indexes, and the `otel_logs` seed adds a materialized -`session.id` column with a skip index, so session queries no longer read the -attribute maps. Only newly created tables get them; existing tables need an -`ALTER TABLE ... ADD COLUMN` to benefit. - -Spans, logs and session replay events from older `@hyperdx/browser` SDKs, which -carry the session id only in the `rum.sessionId` resource attribute, now also -get the OpenTelemetry `session.id` attribute. An existing `session.id` is never -overwritten and `rum.sessionId` is kept. If you override pipeline `processors:` -lists in `CUSTOM_OTELCOL_CONFIG_FILE`, add `transform/session_id` to keep this. - -Logs that carry a severity number but no severity text, such as those from the -new browser SDK, now get the matching level text (`info`, `error`, ...) instead -of an empty level. Severity text set by the producer is never overwritten. diff --git a/.changeset/shared-merge-tree-settings.md b/.changeset/shared-merge-tree-settings.md deleted file mode 100644 index 4c1e0e6932..0000000000 --- a/.changeset/shared-merge-tree-settings.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch -'@hyperdx/common-utils': patch ---- - -feat: on ClickHouse Cloud, read `system.shared_merge_tree_settings` when detecting `_block_number` and `_block_offset` columns, falling back to `system.merge_tree_settings` per key diff --git a/.changeset/sidebar-wordmark-text.md b/.changeset/sidebar-wordmark-text.md deleted file mode 100644 index 4ce27f9bbb..0000000000 --- a/.changeset/sidebar-wordmark-text.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): render the ClickStack name as text in the expanded sidebar, 8px from the logo symbol. diff --git a/.changeset/systeminformation-command-injection.md b/.changeset/systeminformation-command-injection.md deleted file mode 100644 index 3595354a1f..0000000000 --- a/.changeset/systeminformation-command-injection.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: update systeminformation to 5.33.19 - -The root `resolutions` pin let the lockfile keep systeminformation 5.30.7, which -has known command injection advisories, including two high-severity ones in -`networkInterfaces()` on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The -API installs it through `@opentelemetry/instrumentation-host-metrics`, which -asks for `^5.31.6`, but the old pin held it at 5.30.7. The pin now starts at -5.33.19, the newest 5.x release, which fixes all of them. diff --git a/.changeset/time-zone-override.md b/.changeset/time-zone-override.md deleted file mode 100644 index 000c7dc14c..0000000000 --- a/.changeset/time-zone-override.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': minor ---- - -feat: Pick a time zone for the search and dashboard pages from the time picker, overriding the time zone in User Preferences. The picker shows the zone it uses, and the choice is kept in the URL and in links from charts and tables diff --git a/.changeset/trace-waterfall-browser-events.md b/.changeset/trace-waterfall-browser-events.md deleted file mode 100644 index 26be802d3c..0000000000 --- a/.changeset/trace-waterfall-browser-events.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: Trace waterfall shows OpenTelemetry browser SDK request timings as dots on fetch and XHR spans, and the click that triggered a browser trace diff --git a/.changeset/update-favicon.md b/.changeset/update-favicon.md deleted file mode 100644 index 430940f57d..0000000000 --- a/.changeset/update-favicon.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): use the new favicon set, including an SVG, in the browser tab, bookmarks, and touch icon. diff --git a/.changeset/v2-alerts-list-filters.md b/.changeset/v2-alerts-list-filters.md deleted file mode 100644 index 98743b9b01..0000000000 --- a/.changeset/v2-alerts-list-filters.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat: filter the v2 list alerts endpoint by tag, search, source and state diff --git a/.env b/.env index 8ceaf87a8c..ea338c9694 100644 --- a/.env +++ b/.env @@ -9,8 +9,8 @@ NEXT_ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-all-in-one ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-all-in-one NEXT_OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-otel-collector OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-otel-collector -CODE_VERSION=2.43.1 -IMAGE_VERSION_SUB_TAG=.43.1 +CODE_VERSION=2.44.0 +IMAGE_VERSION_SUB_TAG=.44.0 IMAGE_VERSION=2 IMAGE_NIGHTLY_TAG=2-nightly IMAGE_LATEST_TAG=latest diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md index 141ea376a6..aff96fe197 100644 --- a/packages/api/CHANGELOG.md +++ b/packages/api/CHANGELOG.md @@ -1,5 +1,119 @@ # @hyperdx/api +## 2.44.0 + +### Minor Changes + +- cd0e9edfa: feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook +- 5b0d07441: feat: self-instrument with `@clickhouse/clickstack-node` and + `@clickhouse/clickstack-browser` instead of `@hyperdx/node-opentelemetry` and + `@hyperdx/browser` + + HyperDX's own telemetry changes shape. HTTP spans use the stable semantic + convention keys (`http.request.method`, `http.response.status_code`, + `url.full`). pino records come from the `@opentelemetry/instrumentation-pino` + scope with real severity numbers instead of the `node-logger` scope with + severity number 0. Console capture covers every `console` call in the API, and + browser console output is recorded as log records instead of spans. Uncaught + exceptions are recorded as FATAL log records, and API errors as an exception + event on the Express span instead of a separate error span. + + Browser telemetry records the user as `user.id`, `user.email` and `user.name` + instead of `userEmail` and `userName`, keeps the team name as `teamName`, and no + longer records a `user navigated` action. Browser fetch and XHR spans no longer + record request and response headers or bodies. Browser sessions restart once + after the upgrade. The per-signal browser endpoints and + `NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. Browser traces and logs + are now sent gzip-compressed every 5 seconds. If the browser sends to a + collector other than ClickStack's, its CORS `allowed_headers` must be `"*"` or + include `content-type` and `content-encoding` (and `authorization`), and a proxy + in front of it must forward `Content-Encoding` unchanged. + + The Next.js server now sends its own telemetry in production builds too, not + only under `next dev`, when `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` is + set. `HDX_EXPORTER_ENABLED=false` turns it off along with browser telemetry. It + reports under its own service name, the configured one plus `-next` + (`hdx-oss-app-next` in the docker-compose `app` service and when no name is + set), so its spans stay apart from the API's and the browser's. The HyperDX + images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` request + adds Next.js server spans for the proxy hop. Requests for build and `public/` + assets, such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*`, are not traced. + + `HYPERDX_API_KEY` still enables self-instrumentation. Without + `OTEL_EXPORTER_OTLP_ENDPOINT`, server-side self-telemetry now goes to + `http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the + endpoint explicitly. `HDX_NODE_*` variables are no longer read. For request + headers and bodies set `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` and + `CLICKSTACK_CAPTURE_HTTP_BODY`. + +- 349fc2141: feat(mcp): add `clickstack_describe_table` to list the tables in a database and describe a table that is not a registered source (columns, keys, engine, skipping indices, approximate size, optional row sample) +- 0eec5e140: feat: Describe PromQL sources in MCP and hide them when PromQL is disabled + + `clickstack_describe_source` now returns the label names and metric names of a PromQL source, from either a ClickHouse TimeSeries table or a Prometheus-compatible endpoint, instead of a column schema. `clickstack_list_sources` and `clickstack_describe_source` show which backend a PromQL source uses, and for TimeSeries tables explain how to read them with `clickstack_sql`. Prometheus endpoint sources no longer show their placeholder table. When `ENABLE_PROMQL` is off, MCP hides PromQL sources from listing, describing and deleting, and `clickstack_save_source` no longer accepts `kind: "promql"`. + +- 95fa36412: feat(mcp): support setting a dashboard's `savedFilterValues` via the MCP dashboard tools +- c792850fd: feat: filter the v2 list alerts endpoint by tag, search, source and state + +### Patch Changes + +- 0453aa134: fix: A grouped alert whose group vanishes from the data now resolves with the group's values in `{{attributes.*}}` (alert title and message) and `{{var.*}}` (webhook body) +- 5b0d07441: fix: let browsers cache the collector's CORS preflights for 10 minutes + + The OTLP receiver now answers preflights with `Access-Control-Max-Age: 600`. + Without it, browsers cached a preflight for only 5 seconds, which is how often + the browser SDK exports, so about half of its requests were preflights. + +- 769c0def3: fix: ignore `team` and `createdBy` in dashboard and saved search PATCH bodies so they can't be moved to another team or have their owner rewritten +- 5584f84bb: fix: make clickstack_event_patterns drill-down snippets executable + + Each pattern's `whereSnippet` is now a SQL predicate (`whereLanguage: "sql"`) that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to `clickstack_search` returns the pattern's events. Before, a template like `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and map fields produced Lucene that failed to parse. `bodyExpression` now also accepts `JSONExtractString(, '', ...)` to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries. + + `clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard event-pattern tiles now apply the log source's `tableFilterExpression`, so their counts can drop for sources that set one. `minePatterns` now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit. + +- 253a690d4: docs: MCP tool descriptions and the query guide now recommend the quoted Lucene + form `field:"value"` for exact matches, and bare terms or phrases for log body + text, so agents keep the primary key and the text index +- 917c9ca49: feat: MCP dashboard tools read and write PromQL tiles and PROMETHEUS_LABEL filters when PromQL is enabled, and hide but keep them when it is disabled +- d08b2fa73: feat(mcp): `clickstack_sql` accepts a `queries` array to run up to 10 + independent queries in parallel under a shared 60s deadline. Each query reports + its own `ok`/`error`/`timeout` status, so one failing query does not fail the + others. Single-query calls with `sql` behave as before. +- a13c80efe: feat(mcp): `clickstack_table` takes optional `limit` and `having`, and orders grouped results by the first select item, descending, when no `orderBy` is given +- 0262822da: fix: MCP tool responses that are over the size budget now shorten long strings with a `…(+N chars)` suffix instead of replacing them, say what was trimmed in `trimNotes`, and `clickstack_event_patterns` / `clickstack_emerging_signals` drop samples and shorten long patterns before cutting whole patterns, so the requested `topN` survives when it can +- 442d6dfd9: fix: refresh cached table columns after 5 minutes + + The shared metadata cache kept each table's `DESCRIBE` result for the life of + the process, so the API did not see columns added with `ALTER TABLE`, such as + new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 + minutes. Other cached metadata is unchanged. + +- 0eec5e140: fix: Authenticate to Prometheus connections whose host includes credentials + + A Prometheus connection host such as `http://user:pass@prometheus:9090` made every PromQL query fail with "Failed to reach Prometheus", because `fetch` rejects URLs that carry credentials. The credentials are now sent as a Basic auth header. + +- 0a5237e6c: fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL + tiles, and builder tiles with unsupported display types), and drop them when a + dashboard is saved +- b7b4d9579: fix: update systeminformation to 5.33.19 + + The root `resolutions` pin let the lockfile keep systeminformation 5.30.7, which + has known command injection advisories, including two high-severity ones in + `networkInterfaces()` on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The + API installs it through `@opentelemetry/instrumentation-host-metrics`, which + asks for `^5.31.6`, but the old pin held it at 5.30.7. The pin now starts at + 5.33.19, the newest 5.x release, which fixes all of them. + +- Updated dependencies [cd0e9edfa] +- Updated dependencies [e2754d203] +- Updated dependencies [22f824c6e] +- Updated dependencies [d0dd06fe8] +- Updated dependencies [5584f84bb] +- Updated dependencies [41b2b742a] +- Updated dependencies [442d6dfd9] +- Updated dependencies [0a5237e6c] +- Updated dependencies [78143c81a] + - @hyperdx/common-utils@0.34.0 + ## 2.43.1 ## 2.43.0 diff --git a/packages/api/package.json b/packages/api/package.json index 263e58274b..afaefbffca 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/api", - "version": "2.43.1", + "version": "2.44.0", "license": "MIT", "private": true, "engines": { @@ -23,7 +23,7 @@ "@clickhouse/clickstack-node": "^1.0.2", "@clickhouse/client-common": "1.23.0-head.fae5998.1", "@esm2cjs/p-queue": "^7.3.0", - "@hyperdx/common-utils": "^0.33.0", + "@hyperdx/common-utils": "^0.34.0", "@hyperdx/passport-local-mongoose": "^9.0.1", "@modelcontextprotocol/sdk": "^1.27.1", "@opentelemetry/api": "~1.9.1", diff --git a/packages/app/CHANGELOG.md b/packages/app/CHANGELOG.md index e5d45a4fb5..406befb626 100644 --- a/packages/app/CHANGELOG.md +++ b/packages/app/CHANGELOG.md @@ -1,5 +1,129 @@ # @hyperdx/app +## 2.44.0 + +### Minor Changes + +- cd0e9edfa: feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook +- 5b0d07441: feat: self-instrument with `@clickhouse/clickstack-node` and + `@clickhouse/clickstack-browser` instead of `@hyperdx/node-opentelemetry` and + `@hyperdx/browser` + + HyperDX's own telemetry changes shape. HTTP spans use the stable semantic + convention keys (`http.request.method`, `http.response.status_code`, + `url.full`). pino records come from the `@opentelemetry/instrumentation-pino` + scope with real severity numbers instead of the `node-logger` scope with + severity number 0. Console capture covers every `console` call in the API, and + browser console output is recorded as log records instead of spans. Uncaught + exceptions are recorded as FATAL log records, and API errors as an exception + event on the Express span instead of a separate error span. + + Browser telemetry records the user as `user.id`, `user.email` and `user.name` + instead of `userEmail` and `userName`, keeps the team name as `teamName`, and no + longer records a `user navigated` action. Browser fetch and XHR spans no longer + record request and response headers or bodies. Browser sessions restart once + after the upgrade. The per-signal browser endpoints and + `NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. Browser traces and logs + are now sent gzip-compressed every 5 seconds. If the browser sends to a + collector other than ClickStack's, its CORS `allowed_headers` must be `"*"` or + include `content-type` and `content-encoding` (and `authorization`), and a proxy + in front of it must forward `Content-Encoding` unchanged. + + The Next.js server now sends its own telemetry in production builds too, not + only under `next dev`, when `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` is + set. `HDX_EXPORTER_ENABLED=false` turns it off along with browser telemetry. It + reports under its own service name, the configured one plus `-next` + (`hdx-oss-app-next` in the docker-compose `app` service and when no name is + set), so its spans stay apart from the API's and the browser's. The HyperDX + images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` request + adds Next.js server spans for the proxy hop. Requests for build and `public/` + assets, such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*`, are not traced. + + `HYPERDX_API_KEY` still enables self-instrumentation. Without + `OTEL_EXPORTER_OTLP_ENDPOINT`, server-side self-telemetry now goes to + `http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the + endpoint explicitly. `HDX_NODE_*` variables are no longer read. For request + headers and bodies set `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` and + `CLICKSTACK_CAPTURE_HTTP_BODY`. + +- af17e8ff8: The app always uses ClickStack branding. Brand selection, the HyperDX palette, and the font picker are removed. Light, dark, and system color mode stay in Preferences. +- dd8c2e4b6: feat: Pick a time zone for the search and dashboard pages from the time picker, overriding the time zone in User Preferences. The picker shows the zone it uses, and the choice is kept in the URL and in links from charts and tables + +### Patch Changes + +- 7de661b6a: feat: Row side panel summarizes clicks, navigations and console messages from OpenTelemetry browser SDKs, and navigation rows no longer show an HTTP Request section +- ab36d4e13: feat: publish the HyperDX image as `clickhouse/clickstack` alongside + `hyperdx/hyperdx`, matching the other `clickhouse/clickstack-*` images. Release + workflows no longer log into ghcr.io, which received no pushes. +- f56d4ad5b: fix(app): use the ClickStack hexagon and bolt mark in the logo, the collapsed nav, and the favicon. +- d7df729e6: chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack` +- f56d4ad5b: fix(app): open the full nav over the page on compact viewports. On narrow screens the sidebar toggle now opens the full nav as an overlay instead of doing nothing. +- 513b23796: fix: start the trace waterfall higher in the side panel + + Trace spans no longer repeat their name in a box under the panel title, or the + service as a chip next to the metadata row that already shows it. The + "⌘/Ctrl + scroll to zoom" hint moves into the timeline's top-left corner + instead of taking its own row. Long span names that the title truncates keep + the box. Log panels keep their body box and service chip. + +- e2754d203: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row + details and drill-down work on FIPS-enabled ClickHouse deployments +- 5abf27ed3: Saving a search no longer reloads the page: the new saved search is opened with + a client-side navigation, which also fixes the 404 this caused on the static + ClickStack build. +- 04f55d12c: feat: Exception panel parses JavaScript stack traces from OpenTelemetry SDKs into frames, with a section per `Caused by:` error +- d0dd06fe8: fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace + waterfall +- 41b2b742a: feat: fall back to server MergeTree settings to detect persisted `_block_number` and `_block_offset` columns when the table's CREATE query omits them +- 442d6dfd9: fix: refresh cached table columns after 5 minutes + + The shared metadata cache kept each table's `DESCRIBE` result for the life of + the process, so the API did not see columns added with `ALTER TABLE`, such as + new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 + minutes. Other cached metadata is unchanged. + +- 9df8b8d47: fix: bump next to 16.4.3 so builds no longer fail intermittently when Google Fonts returns extensionless font URLs +- ec0db7ac9: fix: Creating an alert from the search page asks for one name, not two. An unsaved search is named once in the alert modal's header and the alert inherits that name and its tags; on a saved search the alert's own name field is labelled "Alert name" and shows the inherited name as its placeholder instead of pre-filling a duplicate. +- 86cd38b7e: fix: only use the key-only row details lookup when the table persists both `_block_number` and `_block_offset`. A lone block column (e.g. a server-wide `enable_block_offset_column`) is not unique with a second-precision primary key and could open the wrong row; it is now only added as a tiebreaker to the full-row lookup. +- 3a412e4f8: fix: run the row details query once when opening a row + + The side panel ran the same `SELECT *` row query twice: once for the panel, and + again when its Overview or Column Values tab mounted. A row that was found is + now reused from the cache, so the tab and later tab switches do not query it + again. A different row or source still runs the query, and a row that was not + found is looked up again. + +- 78143c81a: feat: on ClickHouse Cloud, read `system.shared_merge_tree_settings` when detecting `_block_number` and `_block_offset` columns, falling back to `system.merge_tree_settings` per key +- 4e93ae500: fix(app): render the ClickStack name as text in the expanded sidebar, 8px from the logo symbol. +- af75b2b59: feat: Trace waterfall shows OpenTelemetry browser SDK request timings as dots on fetch and XHR spans, and the click that triggered a browser trace +- 4e93ae500: fix(app): use the new favicon set, including an SVG, in the browser tab, bookmarks, and touch icon. +- Updated dependencies [0453aa134] +- Updated dependencies [cd0e9edfa] +- Updated dependencies [5b0d07441] +- Updated dependencies [5b0d07441] +- Updated dependencies [769c0def3] +- Updated dependencies [e2754d203] +- Updated dependencies [22f824c6e] +- Updated dependencies [d0dd06fe8] +- Updated dependencies [349fc2141] +- Updated dependencies [5584f84bb] +- Updated dependencies [253a690d4] +- Updated dependencies [0eec5e140] +- Updated dependencies [917c9ca49] +- Updated dependencies [95fa36412] +- Updated dependencies [d08b2fa73] +- Updated dependencies [a13c80efe] +- Updated dependencies [0262822da] +- Updated dependencies [41b2b742a] +- Updated dependencies [442d6dfd9] +- Updated dependencies [0eec5e140] +- Updated dependencies [0a5237e6c] +- Updated dependencies [78143c81a] +- Updated dependencies [b7b4d9579] +- Updated dependencies [c792850fd] + - @hyperdx/api@2.44.0 + - @hyperdx/common-utils@0.34.0 + ## 2.43.1 ### Patch Changes diff --git a/packages/app/package.json b/packages/app/package.json index 829742797e..1ade8101ac 100644 --- a/packages/app/package.json +++ b/packages/app/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/app", - "version": "2.43.1", + "version": "2.44.0", "private": true, "license": "MIT", "engines": { @@ -40,7 +40,7 @@ "@dnd-kit/utilities": "^3.2.2", "@hookform/resolvers": "^3.9.0", "@hyperdx/api": "workspace:*", - "@hyperdx/common-utils": "^0.33.0", + "@hyperdx/common-utils": "^0.34.0", "@mantine/core": "^9.0.0", "@mantine/dates": "^9.0.0", "@mantine/dropzone": "^9.0.0", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 270c917d9e..e953579614 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,13 @@ # @hyperdx/cli +## 0.8.1 + +### Patch Changes + +- d7df729e6: chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack` +- e2754d203: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row + details and drill-down work on FIPS-enabled ClickHouse deployments + ## 0.8.0 ### Minor Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 24d75c8850..62ea314c5c 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/cli", - "version": "0.8.0", + "version": "0.8.1", "license": "MIT", "type": "module", "repository": { @@ -41,7 +41,7 @@ }, "devDependencies": { "@clickhouse/client": "1.23.0-head.fae5998.1", - "@hyperdx/common-utils": "^0.33.0", + "@hyperdx/common-utils": "^0.34.0", "@jest/globals": "^30.2.0", "@types/crypto-js": "^4.2.2", "@types/jest": "^29.5.14", diff --git a/packages/common-utils/CHANGELOG.md b/packages/common-utils/CHANGELOG.md index 58cc1c131c..c5e3946e39 100644 --- a/packages/common-utils/CHANGELOG.md +++ b/packages/common-utils/CHANGELOG.md @@ -1,5 +1,37 @@ # @hyperdx/common-utils +## 0.34.0 + +### Minor Changes + +- cd0e9edfa: feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook + +### Patch Changes + +- e2754d203: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row + details and drill-down work on FIPS-enabled ClickHouse deployments +- 22f824c6e: fix: keep JSON path segments with special characters quoted in row detail lookups +- d0dd06fe8: fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace + waterfall +- 5584f84bb: fix: make clickstack_event_patterns drill-down snippets executable + + Each pattern's `whereSnippet` is now a SQL predicate (`whereLanguage: "sql"`) that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to `clickstack_search` returns the pattern's events. Before, a template like `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and map fields produced Lucene that failed to parse. `bodyExpression` now also accepts `JSONExtractString(, '', ...)` to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries. + + `clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard event-pattern tiles now apply the log source's `tableFilterExpression`, so their counts can drop for sources that set one. `minePatterns` now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit. + +- 41b2b742a: feat: fall back to server MergeTree settings to detect persisted `_block_number` and `_block_offset` columns when the table's CREATE query omits them +- 442d6dfd9: fix: refresh cached table columns after 5 minutes + + The shared metadata cache kept each table's `DESCRIBE` result for the life of + the process, so the API did not see columns added with `ALTER TABLE`, such as + new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 + minutes. Other cached metadata is unchanged. + +- 0a5237e6c: fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL + tiles, and builder tiles with unsupported display types), and drop them when a + dashboard is saved +- 78143c81a: feat: on ClickHouse Cloud, read `system.shared_merge_tree_settings` when detecting `_block_number` and `_block_offset` columns, falling back to `system.merge_tree_settings` per key + ## 0.33.0 ### Minor Changes diff --git a/packages/common-utils/package.json b/packages/common-utils/package.json index fb650e0b2d..a7b8cd195d 100644 --- a/packages/common-utils/package.json +++ b/packages/common-utils/package.json @@ -1,7 +1,7 @@ { "name": "@hyperdx/common-utils", "description": "Common utilities for HyperDX application", - "version": "0.33.0", + "version": "0.34.0", "license": "MIT", "private": true, "files": [ diff --git a/packages/otel-collector/CHANGELOG.md b/packages/otel-collector/CHANGELOG.md index 41470c5222..566e6c9cc3 100644 --- a/packages/otel-collector/CHANGELOG.md +++ b/packages/otel-collector/CHANGELOG.md @@ -1,5 +1,42 @@ # @hyperdx/otel-collector +## 2.44.0 + +### Patch Changes + +- 5b0d07441: fix: let browsers cache the collector's CORS preflights for 10 minutes + + The OTLP receiver now answers preflights with `Access-Control-Max-Age: 600`. + Without it, browsers cached a preflight for only 5 seconds, which is how often + the browser SDK exports, so about half of its requests were preflights. + +- 8384fe675: perf: compress the seed schemas with `ZSTD(3)` instead of `ZSTD(1)` + + The seed schemas pinned `ZSTD(1)` on almost every column. Level 3 gives a better + compression ratio at a small insert-time CPU cost, without affecting reads, and + it is the default codec of ClickHouse since 26.9. It is pinned explicitly so + that older ClickHouse versions, whose default is `LZ4`, get it too. `Delta` + codecs drop their byte-size argument, which ClickHouse infers from the column + type. Only newly created tables are affected; existing tables keep their codecs. + +- 702181002: feat: session ID columns, `session.id` from `rum.sessionId`, severity text + + The `hyperdx_sessions` seed adds materialized `rum.sessionId` and `session.id` + columns with skip indexes, and the `otel_logs` seed adds a materialized + `session.id` column with a skip index, so session queries no longer read the + attribute maps. Only newly created tables get them; existing tables need an + `ALTER TABLE ... ADD COLUMN` to benefit. + + Spans, logs and session replay events from older `@hyperdx/browser` SDKs, which + carry the session id only in the `rum.sessionId` resource attribute, now also + get the OpenTelemetry `session.id` attribute. An existing `session.id` is never + overwritten and `rum.sessionId` is kept. If you override pipeline `processors:` + lists in `CUSTOM_OTELCOL_CONFIG_FILE`, add `transform/session_id` to keep this. + + Logs that carry a severity number but no severity text, such as those from the + new browser SDK, now get the matching level text (`info`, `error`, ...) instead + of an empty level. Severity text set by the producer is never overwritten. + ## 2.43.1 ### Patch Changes diff --git a/packages/otel-collector/package.json b/packages/otel-collector/package.json index 8636220ca9..62fcb6d9a0 100644 --- a/packages/otel-collector/package.json +++ b/packages/otel-collector/package.json @@ -1,7 +1,7 @@ { "name": "@hyperdx/otel-collector", "description": "HyperDX OpenTelemetry Collector configuration and Docker image", - "version": "2.43.1", + "version": "2.44.0", "license": "MIT", "private": true } diff --git a/yarn.lock b/yarn.lock index 1840c79899..870d51494e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4772,7 +4772,7 @@ __metadata: "@clickhouse/clickstack-node": "npm:^1.0.2" "@clickhouse/client-common": "npm:1.23.0-head.fae5998.1" "@esm2cjs/p-queue": "npm:^7.3.0" - "@hyperdx/common-utils": "npm:^0.33.0" + "@hyperdx/common-utils": "npm:^0.34.0" "@hyperdx/passport-local-mongoose": "npm:^9.0.1" "@modelcontextprotocol/sdk": "npm:^1.27.1" "@opentelemetry/api": "npm:~1.9.1" @@ -4869,7 +4869,7 @@ __metadata: "@eslint/compat": "npm:^2.0.0" "@hookform/resolvers": "npm:^3.9.0" "@hyperdx/api": "workspace:*" - "@hyperdx/common-utils": "npm:^0.33.0" + "@hyperdx/common-utils": "npm:^0.34.0" "@mantine/core": "npm:^9.0.0" "@mantine/dates": "npm:^9.0.0" "@mantine/dropzone": "npm:^9.0.0" @@ -4987,7 +4987,7 @@ __metadata: resolution: "@hyperdx/cli@workspace:packages/cli" dependencies: "@clickhouse/client": "npm:1.23.0-head.fae5998.1" - "@hyperdx/common-utils": "npm:^0.33.0" + "@hyperdx/common-utils": "npm:^0.34.0" "@jest/globals": "npm:^30.2.0" "@types/crypto-js": "npm:^4.2.2" "@types/jest": "npm:^29.5.14" @@ -5014,7 +5014,7 @@ __metadata: languageName: unknown linkType: soft -"@hyperdx/common-utils@npm:^0.33.0, @hyperdx/common-utils@workspace:packages/common-utils": +"@hyperdx/common-utils@npm:^0.34.0, @hyperdx/common-utils@workspace:packages/common-utils": version: 0.0.0-use.local resolution: "@hyperdx/common-utils@workspace:packages/common-utils" dependencies: From a11c18c6e81edb226f47c4aa4bc40b1890340eb5 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 7 Nov 2026 03:22:21 +0000 Subject: [PATCH 2/2] chore(release): update root CHANGELOG.md --- CHANGELOG.md | 293 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 293 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d71cc72fe..c6157ba281 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,299 @@ PR — keep the `hyperdx-release-notes` comment marker intact when editing so yo edits survive regeneration. Per-package detail lives in each `packages/*/CHANGELOG.md`. +## v2.44.0 — 2026-11-07 + + + +**Time zone picker and optional webhook emoji** + +You can now pick a time zone straight from the time picker on the search and +dashboard pages, overriding the one set in your User Preferences. Webhooks now +take an optional `titleEmoji` setting: set it to `false` and notification titles +sent through that webhook arrive without the emoji prefix. Columns added to a +ClickHouse table after HyperDX starts — a new MATERIALIZED column, say — are now +visible within five minutes, with no restart needed. Note before upgrading that +the app now always uses ClickStack branding — brand selection, the HyperDX +palette and the font picker are gone — and that HyperDX instruments itself with +the ClickStack SDKs now, which changes the shape of its own telemetry and where +that telemetry goes by default. + +### 💥 Breaking Changes + +- **ClickStack branding is now the only theme**: brand selection, the HyperDX + palette and the font picker have been removed, so the app always uses + ClickStack branding and its standard font. If you or your team had chosen the + HyperDX palette or a different font, that choice no longer applies. Light, + dark and system colour mode stay in Preferences. +- **HyperDX self-instruments with the ClickStack SDKs**: HyperDX's own telemetry + now comes from `@clickhouse/clickstack-node` and + `@clickhouse/clickstack-browser` in place of `@hyperdx/node-opentelemetry` and + `@hyperdx/browser`, and it changes shape. HTTP spans carry the stable semantic + convention keys (`http.request.method`, `http.response.status_code`, + `url.full`), pino records arrive under the + `@opentelemetry/instrumentation-pino` scope with real severity numbers instead + of the `node-logger` scope at severity number 0, console capture covers every + `console` call in the API, browser console output is recorded as log records + rather than spans, uncaught exceptions are recorded as FATAL log records, and + an API error is an exception event on the Express span instead of a separate + error span. Browser telemetry names the user as `user.id`, `user.email` and + `user.name` instead of `userEmail` and `userName`, keeps the team name as + `teamName`, no longer records a `user navigated` action, and no longer records + request and response headers or bodies on fetch and XHR spans; browser + sessions restart once after the upgrade. Update anything — a saved search, + alert or dashboard — keyed on the old attribute names before you upgrade. +- **Self-telemetry is configured with the OpenTelemetry variables**: + `HYPERDX_API_KEY` still enables self-instrumentation, but without + `OTEL_EXPORTER_OTLP_ENDPOINT` server-side self-telemetry now goes to + `http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the + endpoint explicitly. `HDX_NODE_*` variables are no longer read; capture + request headers and bodies with `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` + and `CLICKSTACK_CAPTURE_HTTP_BODY` instead. Browser traces and logs are now + sent gzip-compressed every 5 seconds, so if the browser sends to a collector + other than ClickStack's, that collector's CORS `allowed_headers` must be `"*"` + or include `content-type` and `content-encoding` (and `authorization`), and a + proxy in front of it must forward `Content-Encoding` unchanged. The per-signal + browser endpoints and `NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. +- **The Next.js server reports telemetry from production builds too**: with + `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` set, the Next.js server now + sends its own telemetry in production builds, not only under `next dev`. It + reports under its own service name — the configured one plus `-next` + (`hdx-oss-app-next` in the docker-compose `app` service and when no name is + set) — so its spans stay apart from the API's and the browser's, and the + HyperDX images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` + request gains Next.js server spans for the proxy hop, while requests for build + and `public/` assets such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*` + are not traced. `HDX_EXPORTER_ENABLED=false` turns it off along with browser + telemetry. + +### ✨ New Features + +- **Pick a time zone from the time picker**: the search and dashboard pages let + you choose the time zone they display, overriding the zone set in User + Preferences. The picker shows the zone it is using, and your choice is kept in + the URL and carried through links from charts and tables, so a shared link + opens in the same zone you were reading. +- **Emoji prefix in webhook titles is now optional**: webhooks take a new + `titleEmoji` option, and setting it to `false` sends notification titles + through that webhook without the leading emoji — useful where the receiving + system renders it poorly or your team would rather read a plain title. +- **Browser events on the trace waterfall and in the row side panel**: the + waterfall now plots the request timings an OpenTelemetry browser SDK records + as dots along fetch and XHR spans, and shows the click that triggered a + browser trace, so you can see where time went in the browser without leaving + the trace. The row side panel summarises the clicks, navigations and console + messages those SDKs record, and navigation rows no longer show an HTTP Request + section that never applied to them. +- **JavaScript stack traces broken into frames**: the Exception panel now parses + the JavaScript stack traces that OpenTelemetry SDKs report into individual + frames, with its own section for each `Caused by:` error, so you can follow an + exception and the errors behind it instead of reading one block of text. +- **Session IDs from older browser SDKs land on `session.id`**: spans, logs and + session replay events from older `@hyperdx/browser` SDKs carry the session id + only in the `rum.sessionId` resource attribute, and the collector now gives + them the OpenTelemetry `session.id` attribute as well, so anything keyed off + the standard attribute sees them too. An existing `session.id` is never + overwritten and `rum.sessionId` is kept; if you override pipeline + `processors:` lists in `CUSTOM_OTELCOL_CONFIG_FILE`, add `transform/session_id` + to keep this. Newly created `hyperdx_sessions` and `otel_logs` tables also get + `MATERIALIZED` session id columns with skip indexes, so session queries no + longer read the attribute maps — existing tables need an + `ALTER TABLE ... ADD COLUMN` to benefit. +- **Filter the v2 list alerts endpoint**: the v2 API for listing alerts now + accepts tag, search, source and state filters, so you can ask for just the + alerts you care about rather than fetching them all and filtering yourself. +- **Describe any table over MCP**: the new `clickstack_describe_table` tool + lists the tables in a database and describes one that is not a registered + source — its columns, keys, engine, skipping indices, approximate size and an + optional row sample — so an assistant can look into data you have not set up + as a source yet. +- **Set a dashboard's saved filter values over MCP**: the MCP dashboard tools + can now set a dashboard's `savedFilterValues`, so an assistant building or + updating a dashboard can leave its filters pre-filled rather than having you + set them by hand afterwards. +- **Run up to ten MCP SQL queries in parallel**: `clickstack_sql` now accepts a + `queries` array and runs up to ten independent queries at once under a shared + 60 second deadline, with each query reporting its own `ok`, `error` or + `timeout` status so one failure does not take the others down with it. + Single-query calls using `sql` behave exactly as before. +- **Narrower MCP table queries**: `clickstack_table` now takes an optional + `limit` and `having`, so an assistant can cut a grouped result down to the + rows worth reading rather than filtering them afterwards. Grouped results with + no `orderBy` now come back ordered by the first select item, descending, which + puts the largest values first instead of leaving the order to ClickHouse. + +### 🧪 Experimental + +PromQL support is gated behind the `ENABLE_PROMQL` flag; these changes apply +once it is on. + +- **PromQL sources and tiles over MCP**: `clickstack_describe_source` now + returns a PromQL source's label names and metric names — from a ClickHouse + TimeSeries table or a Prometheus-compatible endpoint — instead of a column + schema, and both it and `clickstack_list_sources` say which backend the source + uses, explaining how to read a TimeSeries table with `clickstack_sql`. + Prometheus endpoint sources no longer show a placeholder table, and the MCP + dashboard tools read and write PromQL tiles and `PROMETHEUS_LABEL` filters. + With `ENABLE_PROMQL` off, MCP hides PromQL sources from listing, describing + and deleting, `clickstack_save_source` no longer accepts `kind: "promql"`, and + the dashboard tools hide PromQL tiles rather than discarding them, so a + dashboard edited through MCP keeps its PromQL tiles intact. + +### 🔧 Improvements + +- **The ClickStack hexagon and bolt mark across the app**: the logo, the + collapsed nav and the favicon now carry the ClickStack hexagon and bolt mark, + so the browser tab and the sidebar match the branding the rest of the app + uses. The expanded sidebar spells out the ClickStack name as text beside the + symbol, and a new favicon set, an SVG included, covers the browser tab, + bookmarks and touch icon. +- **A tighter trace side panel**: the trace waterfall starts higher up the + panel, because a span no longer repeats its name in a box under the panel + title or shows its service as a chip beside the metadata row that already + names it, and the "⌘/Ctrl + scroll to zoom" hint has moved into the timeline's + top-left corner instead of claiming a row of its own. Span names too long for + the title keep their box, and log panels are unchanged. +- **Opening a row queries it once**: the side panel ran the same `SELECT *` row + query twice, once for the panel and again when its Overview or Column Values + tab mounted. A row that was found is now reused from the cache, so that tab + and later tab switches do not query it again; a different row or source still + runs the query, and a row that was not found is looked up again. +- **One name when you alert on a search**: creating an alert from the search + page now asks for a single name rather than two. An unsaved search is named + once in the alert modal's header and the alert inherits that name and its + tags; on a saved search the alert's own field is labelled "Alert name" and + shows the inherited name as its placeholder instead of pre-filling a + duplicate. +- **Better compression for newly created tables**: the collector's seed schemas + now pin `ZSTD(3)` rather than `ZSTD(1)`, which compresses your data further + for a small insert-time CPU cost and no change to read performance. Only + tables created from here on are affected; existing tables keep the codecs they + already have. +- **Logs with a severity number but no severity text get a level**: logs that + arrive with a severity number and an empty severity text, such as those from + the new browser SDK, now get the matching level text (`info`, `error`, and so + on), so they read and filter like every other log. Severity text set by the + producer is never overwritten. +- **Browsers cache the collector's CORS preflights for 10 minutes**: the OTLP + receiver now answers preflight requests with `Access-Control-Max-Age: 600`. + Browsers previously cached a preflight for only 5 seconds, which is exactly + how often the browser SDK exports, so about half of its requests to the + collector were preflights. +- **Persisted `_block_number` and `_block_offset` columns detected more + reliably**: when a table's `CREATE` query omits them, HyperDX now falls back to + the server's MergeTree settings to work out whether they are persisted — + reading `system.shared_merge_tree_settings` first on ClickHouse Cloud, then + `system.merge_tree_settings` per key — so the features that rely on those + columns keep working on tables where the setting is applied server-side rather + than spelled out in the schema. +- **Sharper query guidance for MCP agents**: the MCP tool descriptions and the + query guide now recommend the quoted Lucene form `field:"value"` for exact + matches, and bare terms or phrases for log body text, so the queries an + assistant writes still make use of the primary key and the text index. + +### 🐛 Bug Fixes + +- **Cached table columns refresh after 5 minutes**: the metadata cache kept each + table's `DESCRIBE` result for the life of the process, so columns added with + `ALTER TABLE`, such as new MATERIALIZED columns, were not picked up until the + API restarted. Cached columns now expire after 5 minutes; other cached + metadata is unchanged. +- **Alerts can no longer be set on tiles that never fire**: dashboard tiles the + alert checker does not evaluate — PromQL tiles, and builder tiles with an + unsupported display type — now reject alerts outright, instead of accepting + one that stayed silent forever. Any such alert already saved is dropped the + next time its dashboard is saved, so move it to a tile the checker supports if + you were relying on it. +- **Resolved grouped alerts name the group that resolved**: when a group + vanishes from the data, the alert resolves with that group's values filled in + for `{{attributes.*}}` in the title and message, and `{{var.*}}` in the webhook + body, so you can tell from the notification which group went quiet. +- **Row detail lookups work on FIPS ClickHouse and with special characters in + JSON keys**: looking up a JSON row no longer relies on MD5, which FIPS-enabled + deployments refuse to run — the lookup uses SHA256 instead — and path segments + containing special characters, a key prefixed with `@`, say, now stay quoted. + Row details and drill-down return the row rather than failing or reading the + key as something else. +- **Row details no longer open the wrong row on tables with a single block + column**: the key-only lookup is used only where a table persists both + `_block_number` and `_block_offset`. One block column on its own — from a + server-wide `enable_block_offset_column`, say — is not unique against a + second-precision primary key and could open a different row, so it is now + added only as a tiebreaker to the full-row lookup. +- **Legacy `STATUS_CODE_ERROR` spans count as errors on the service map and + trace waterfall**: spans from collectors that emit the long status form were + not recognised as errored in either view, so both undercounted errors. That + value is now counted alongside the short `Error` form. +- **Prometheus connections with credentials in the host work again**: a host + such as `http://user:pass@prometheus:9090` failed every PromQL query with + "Failed to reach Prometheus", because `fetch` rejects URLs carrying + credentials. Those credentials are now sent as a Basic auth header instead. +- **Saving a search no longer reloads the page**: the newly saved search opens + with a client-side navigation instead of a full page load, which also fixes + the 404 this caused on the static ClickStack build. +- **The sidebar toggle works on narrow screens**: on compact viewports the + toggle did nothing at all. It now opens the full nav as an overlay over the + page, so you can reach every section without widening the window. +- **Dashboards and saved searches keep their team and owner**: a PATCH request + that included `team` or `createdBy` could move a dashboard or saved search to + another team, or rewrite who owned it. Both fields are now ignored on update, + so neither can be changed that way. +- **Event pattern drill-downs return the events they describe**: each pattern + from `clickstack_event_patterns` now carries a SQL `whereSnippet` that keeps + the template's token order and variable positions and includes both the + caller's filter and the source table filter, so handing it to + `clickstack_search` returns that pattern's events. Previously a template like + `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and + map fields produced Lucene that would not parse. Patterns can also be mined + from a key inside a JSON body, and the tool now reports its sample coverage + and the trend bucket interval and boundaries it actually used. + `clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard + event-pattern tiles also apply the log source's `tableFilterExpression` now, + so their counts can drop for sources that set one, and each cluster is + reported with its own template rather than occasionally that of a different + cluster of the same length. +- **Oversized MCP responses keep more of what you asked for**: a response over + the size budget now shortens a long string with a `…(+N chars)` suffix instead + of replacing it outright, and records what it cut in `trimNotes`. + `clickstack_event_patterns` and `clickstack_emerging_signals` drop samples and + shorten long patterns before they discard whole patterns, so the `topN` you + asked for survives wherever it can. + +### 📦 Build / Packaging + +- **systeminformation updated past its command injection advisories**: the API + pulls systeminformation in through + `@opentelemetry/instrumentation-host-metrics`, but the root `resolutions` pin + held the lockfile at 5.30.7, which carries known command injection advisories + — among them two high-severity ones in `networkInterfaces()` on Linux + (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The pin now starts at 5.33.19, the + newest 5.x release, which fixes all of them. +- **The app image is now published as `clickhouse/clickstack` as well**: the + HyperDX image goes out under `clickhouse/clickstack` alongside the existing + `hyperdx/hyperdx`, matching the other `clickhouse/clickstack-*` images, so you + can pull it under either name. Release workflows no longer log in to ghcr.io, + which was receiving no pushes. +- **Project links and the bundled compose file point at ClickStack**: the GitHub + links the app and packages carry — changelog, support and package metadata — + now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app + image as `clickhouse/clickstack`. +- **App builds no longer fail on extensionless Google Fonts URLs**: the app + moves to Next.js 16.4.3, fixing the intermittent build failures that happened + when Google Fonts returned a font URL without a file extension. Only builds of + the app from source are affected. + + + +### 📦 Package changelogs + +- `@hyperdx/api` 2.43.1 → 2.44.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/api/CHANGELOG.md#2440) +- `@hyperdx/app` 2.43.1 → 2.44.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/app/CHANGELOG.md#2440) +- `@hyperdx/cli` 0.8.0 → 0.8.1 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/cli/CHANGELOG.md#081) +- `@hyperdx/common-utils` 0.33.0 → 0.34.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/common-utils/CHANGELOG.md#0340) +- `@hyperdx/otel-collector` 2.43.1 → 2.44.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/otel-collector/CHANGELOG.md#2440) + + + ## v2.43.1 — 2026-10-31