diff --git a/.changeset/adhoc-filter-suggestions-where.md b/.changeset/adhoc-filter-suggestions-where.md deleted file mode 100644 index 402c28379..000000000 --- a/.changeset/adhoc-filter-suggestions-where.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -'@hyperdx/common-utils': minor -'@hyperdx/app': minor ---- - -feat: narrow ad hoc dashboard filter suggestions with a condition - -An ad hoc filter on SQL sources can now carry a SQL or Lucene "Keys and values -filter", like a queried filter's dropdown values filter, that limits the rows -its keys and values are suggested from. It can reference the dashboard's other -variables. While it references a required filter with nothing selected, the ad -hoc filter can't add or edit conditions and names the filter it is waiting on. -Failed suggestions now show the database's error message. diff --git a/.changeset/alert-evaluator-extension-point.md b/.changeset/alert-evaluator-extension-point.md deleted file mode 100644 index ed39fc733..000000000 --- a/.changeset/alert-evaluator-extension-point.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat: add an internal extension point for alert detection strategies; threshold alerts are evaluated as before, and the `alerts.evaluate` metric now carries an `alert_evaluator` attribute diff --git a/.changeset/alert-resolve-vanished-group-values.md b/.changeset/alert-resolve-vanished-group-values.md deleted file mode 100644 index fd926ea13..000000000 --- a/.changeset/alert-resolve-vanished-group-values.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: A grouped alert whose group vanishes from the data now resolves with the group's values in `{{attributes.*}}` (alert title and message) and `{{var.*}}` (webhook body) diff --git a/.changeset/alert-title-emoji-toggle.md b/.changeset/alert-title-emoji-toggle.md deleted file mode 100644 index 86158ae7c..000000000 --- a/.changeset/alert-title-emoji-toggle.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': minor -'@hyperdx/app': minor -'@hyperdx/common-utils': minor ---- - -feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook diff --git a/.changeset/browser-event-row-summary.md b/.changeset/browser-event-row-summary.md deleted file mode 100644 index 0b4e69838..000000000 --- a/.changeset/browser-event-row-summary.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: Row side panel summarizes clicks, navigations and console messages from OpenTelemetry browser SDKs, and navigation rows no longer show an HTTP Request section diff --git a/.changeset/clickstack-app-image.md b/.changeset/clickstack-app-image.md deleted file mode 100644 index aa4201152..000000000 --- a/.changeset/clickstack-app-image.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: publish the HyperDX image as `clickhouse/clickstack` alongside -`hyperdx/hyperdx`, matching the other `clickhouse/clickstack-*` images. Release -workflows no longer log into ghcr.io, which received no pushes. diff --git a/.changeset/clickstack-hexagon-mark.md b/.changeset/clickstack-hexagon-mark.md deleted file mode 100644 index fa0340f45..000000000 --- a/.changeset/clickstack-hexagon-mark.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): use the ClickStack hexagon and bolt mark in the logo, the collapsed nav, and the favicon. diff --git a/.changeset/clickstack-repo-links.md b/.changeset/clickstack-repo-links.md deleted file mode 100644 index 0bea2b482..000000000 --- a/.changeset/clickstack-repo-links.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch -'@hyperdx/cli': patch ---- - -chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack` diff --git a/.changeset/clickstack-sdks.md b/.changeset/clickstack-sdks.md deleted file mode 100644 index 16aaacfdb..000000000 --- a/.changeset/clickstack-sdks.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -'@hyperdx/api': minor -'@hyperdx/app': minor ---- - -feat: self-instrument with `@clickhouse/clickstack-node` and -`@clickhouse/clickstack-browser` instead of `@hyperdx/node-opentelemetry` and -`@hyperdx/browser` - -HyperDX's own telemetry changes shape. HTTP spans use the stable semantic -convention keys (`http.request.method`, `http.response.status_code`, -`url.full`). pino records come from the `@opentelemetry/instrumentation-pino` -scope with real severity numbers instead of the `node-logger` scope with -severity number 0. Console capture covers every `console` call in the API, and -browser console output is recorded as log records instead of spans. Uncaught -exceptions are recorded as FATAL log records, and API errors as an exception -event on the Express span instead of a separate error span. - -Browser telemetry records the user as `user.id`, `user.email` and `user.name` -instead of `userEmail` and `userName`, keeps the team name as `teamName`, and no -longer records a `user navigated` action. Browser fetch and XHR spans no longer -record request and response headers or bodies. Browser sessions restart once -after the upgrade. The per-signal browser endpoints and -`NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. Browser traces and logs -are now sent gzip-compressed every 5 seconds. If the browser sends to a -collector other than ClickStack's, its CORS `allowed_headers` must be `"*"` or -include `content-type` and `content-encoding` (and `authorization`), and a proxy -in front of it must forward `Content-Encoding` unchanged. - -The Next.js server now sends its own telemetry in production builds too, not -only under `next dev`, when `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` is -set. `HDX_EXPORTER_ENABLED=false` turns it off along with browser telemetry. It -reports under its own service name, the configured one plus `-next` -(`hdx-oss-app-next` in the docker-compose `app` service and when no name is -set), so its spans stay apart from the API's and the browser's. The HyperDX -images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` request -adds Next.js server spans for the proxy hop. Requests for build and `public/` -assets, such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*`, are not traced. - -`HYPERDX_API_KEY` still enables self-instrumentation. Without -`OTEL_EXPORTER_OTLP_ENDPOINT`, server-side self-telemetry now goes to -`http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the -endpoint explicitly. `HDX_NODE_*` variables are no longer read. For request -headers and bodies set `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` and -`CLICKSTACK_CAPTURE_HTTP_BODY`. diff --git a/.changeset/collector-cors-max-age.md b/.changeset/collector-cors-max-age.md deleted file mode 100644 index 264c7d33a..000000000 --- a/.changeset/collector-cors-max-age.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/api': patch -'@hyperdx/otel-collector': patch ---- - -fix: let browsers cache the collector's CORS preflights for 10 minutes - -The OTLP receiver now answers preflights with `Access-Control-Max-Age: 600`. -Without it, browsers cached a preflight for only 5 seconds, which is how often -the browser SDK exports, so about half of its requests were preflights. diff --git a/.changeset/compact-nav-overlay.md b/.changeset/compact-nav-overlay.md deleted file mode 100644 index 9524154a6..000000000 --- a/.changeset/compact-nav-overlay.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): open the full nav over the page on compact viewports. On narrow screens the sidebar toggle now opens the full nav as an overlay instead of doing nothing. diff --git a/.changeset/compact-trace-side-panel.md b/.changeset/compact-trace-side-panel.md deleted file mode 100644 index feb0782f4..000000000 --- a/.changeset/compact-trace-side-panel.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: start the trace waterfall higher in the side panel - -Trace spans no longer repeat their name in a box under the panel title, or the -service as a chip next to the metadata row that already shows it. The -"⌘/Ctrl + scroll to zoom" hint moves into the timeline's top-left corner -instead of taking its own row. Long span names that the title truncates keep -the box. Log panels keep their body box and service chip. diff --git a/.changeset/dashboard-patch-team-immutable.md b/.changeset/dashboard-patch-team-immutable.md deleted file mode 100644 index 2b7f5b6ab..000000000 --- a/.changeset/dashboard-patch-team-immutable.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: ignore `team` and `createdBy` in dashboard and saved search PATCH bodies so they can't be moved to another team or have their owner rewritten diff --git a/.changeset/default-compression-codec.md b/.changeset/default-compression-codec.md deleted file mode 100644 index c9ebffdda..000000000 --- a/.changeset/default-compression-codec.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/otel-collector': patch ---- - -perf: compress the seed schemas with `ZSTD(3)` instead of `ZSTD(1)` - -The seed schemas pinned `ZSTD(1)` on almost every column. Level 3 gives a better -compression ratio at a small insert-time CPU cost, without affecting reads, and -it is the default codec of ClickHouse since 26.9. It is pinned explicitly so -that older ClickHouse versions, whose default is `LZ4`, get it too. `Delta` -codecs drop their byte-size argument, which ClickHouse infers from the column -type. Only newly created tables are affected; existing tables keep their codecs. diff --git a/.changeset/external-api-min-auto-granularity.md b/.changeset/external-api-min-auto-granularity.md deleted file mode 100644 index c63e6f77b..000000000 --- a/.changeset/external-api-min-auto-granularity.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -docs: Document `minAutoGranularity` on metric and PromQL sources in the external -API - -`GET`, `POST` and `PUT /api/v2/sources` already accepted and returned -`minAutoGranularity`, but the OpenAPI spec omitted it, so clients generated from -the spec dropped or rejected the field. diff --git a/.changeset/fips-row-lookup-sha256.md b/.changeset/fips-row-lookup-sha256.md deleted file mode 100644 index 5330967a3..000000000 --- a/.changeset/fips-row-lookup-sha256.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch -'@hyperdx/cli': patch ---- - -fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row -details and drill-down work on FIPS-enabled ClickHouse deployments diff --git a/.changeset/fix-at-prefixed-json-key-row-details.md b/.changeset/fix-at-prefixed-json-key-row-details.md deleted file mode 100644 index 4f9ea6a09..000000000 --- a/.changeset/fix-at-prefixed-json-key-row-details.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/common-utils': patch ---- - -fix: keep JSON path segments with special characters quoted in row detail lookups diff --git a/.changeset/fix-saved-search-client-side-navigation.md b/.changeset/fix-saved-search-client-side-navigation.md deleted file mode 100644 index 70d921981..000000000 --- a/.changeset/fix-saved-search-client-side-navigation.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -Saving a search no longer reloads the page: the new saved search is opened with -a client-side navigation, which also fixes the 404 this caused on the static -ClickStack build. diff --git a/.changeset/javascript-exception-stack-frames.md b/.changeset/javascript-exception-stack-frames.md deleted file mode 100644 index 48d845b14..000000000 --- a/.changeset/javascript-exception-stack-frames.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: Exception panel parses JavaScript stack traces from OpenTelemetry SDKs into frames, with a section per `Caused by:` error diff --git a/.changeset/legacy-span-error-status.md b/.changeset/legacy-span-error-status.md deleted file mode 100644 index 783bf8f37..000000000 --- a/.changeset/legacy-span-error-status.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch ---- - -fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace -waterfall diff --git a/.changeset/mcp-describe-table.md b/.changeset/mcp-describe-table.md deleted file mode 100644 index bd4e02299..000000000 --- a/.changeset/mcp-describe-table.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat(mcp): add `clickstack_describe_table` to list the tables in a database and describe a table that is not a registered source (columns, keys, engine, skipping indices, approximate size, optional row sample) diff --git a/.changeset/mcp-event-patterns-drilldown.md b/.changeset/mcp-event-patterns-drilldown.md deleted file mode 100644 index edda3830e..000000000 --- a/.changeset/mcp-event-patterns-drilldown.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/api': patch -'@hyperdx/common-utils': patch ---- - -fix: make clickstack_event_patterns drill-down snippets executable - -Each pattern's `whereSnippet` is now a SQL predicate (`whereLanguage: "sql"`) that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to `clickstack_search` returns the pattern's events. Before, a template like `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and map fields produced Lucene that failed to parse. `bodyExpression` now also accepts `JSONExtractString(, '', ...)` to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries. - -`clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard event-pattern tiles now apply the log source's `tableFilterExpression`, so their counts can drop for sources that set one. `minePatterns` now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit. diff --git a/.changeset/mcp-lucene-exact-match.md b/.changeset/mcp-lucene-exact-match.md deleted file mode 100644 index 853bb32a8..000000000 --- a/.changeset/mcp-lucene-exact-match.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -docs: MCP tool descriptions and the query guide now recommend the quoted Lucene -form `field:"value"` for exact matches, and bare terms or phrases for log body -text, so agents keep the primary key and the text index diff --git a/.changeset/mcp-promql-query-tile.md b/.changeset/mcp-promql-query-tile.md deleted file mode 100644 index 19ada9d6d..000000000 --- a/.changeset/mcp-promql-query-tile.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat: MCP `query_tile` and `query_tiles` run PromQL tiles against Prometheus endpoints and ClickHouse TimeSeries tables diff --git a/.changeset/mcp-promql-query-tool.md b/.changeset/mcp-promql-query-tool.md deleted file mode 100644 index 63e6087b7..000000000 --- a/.changeset/mcp-promql-query-tool.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat: MCP `clickstack_promql` tool runs PromQL against a PromQL source, and the MCP prompts and instructions cover PromQL sources, tiles and label filters while PromQL is enabled diff --git a/.changeset/mcp-promql-response-cap.md b/.changeset/mcp-promql-response-cap.md deleted file mode 100644 index bd6042062..000000000 --- a/.changeset/mcp-promql-response-cap.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: Refuse Prometheus endpoint responses over 8 MB in MCP PromQL label lookups and queries, instead of buffering them whole diff --git a/.changeset/mcp-promql-shared-chart.md b/.changeset/mcp-promql-shared-chart.md deleted file mode 100644 index 12a3d67c7..000000000 --- a/.changeset/mcp-promql-shared-chart.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: MCP `query_tile` returns PromQL table and histogram heatmap tiles in the rows the dashboard draws diff --git a/.changeset/mcp-promql-sources.md b/.changeset/mcp-promql-sources.md deleted file mode 100644 index f90a0a187..000000000 --- a/.changeset/mcp-promql-sources.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat: Describe PromQL sources in MCP and hide them when PromQL is disabled - -`clickstack_describe_source` now returns the label names and metric names of a PromQL source, from either a ClickHouse TimeSeries table or a Prometheus-compatible endpoint, instead of a column schema. `clickstack_list_sources` and `clickstack_describe_source` show which backend a PromQL source uses, and for TimeSeries tables explain how to read them with `clickstack_sql`. Prometheus endpoint sources no longer show their placeholder table. When `ENABLE_PROMQL` is off, MCP hides PromQL sources from listing, describing and deleting, and `clickstack_save_source` no longer accepts `kind: "promql"`. diff --git a/.changeset/mcp-promql-tiles.md b/.changeset/mcp-promql-tiles.md deleted file mode 100644 index 5f7b54caf..000000000 --- a/.changeset/mcp-promql-tiles.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat: MCP dashboard tools read and write PromQL tiles and PROMETHEUS_LABEL filters when PromQL is enabled, and hide but keep them when it is disabled diff --git a/.changeset/mcp-saved-filter-values.md b/.changeset/mcp-saved-filter-values.md deleted file mode 100644 index cb452dd46..000000000 --- a/.changeset/mcp-saved-filter-values.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat(mcp): support setting a dashboard's `savedFilterValues` via the MCP dashboard tools diff --git a/.changeset/mcp-sql-batch-queries.md b/.changeset/mcp-sql-batch-queries.md deleted file mode 100644 index 266c57697..000000000 --- a/.changeset/mcp-sql-batch-queries.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat(mcp): `clickstack_sql` accepts a `queries` array to run up to 10 -independent queries in parallel under a shared 60s deadline. Each query reports -its own `ok`/`error`/`timeout` status, so one failing query does not fail the -others. Single-query calls with `sql` behave as before. diff --git a/.changeset/mcp-table-limit-having-order.md b/.changeset/mcp-table-limit-having-order.md deleted file mode 100644 index b03351d00..000000000 --- a/.changeset/mcp-table-limit-having-order.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -feat(mcp): `clickstack_table` takes optional `limit` and `having`, and orders grouped results by the first select item, descending, when no `orderBy` is given diff --git a/.changeset/mcp-trim-shorten-reductions.md b/.changeset/mcp-trim-shorten-reductions.md deleted file mode 100644 index 4f319e828..000000000 --- a/.changeset/mcp-trim-shorten-reductions.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: MCP tool responses that are over the size budget now shorten long strings with a `…(+N chars)` suffix instead of replacing them, say what was trimmed in `trimNotes`, and `clickstack_event_patterns` / `clickstack_emerging_signals` drop samples and shorten long patterns before cutting whole patterns, so the requested `topN` survives when it can diff --git a/.changeset/merge-tree-settings-block-columns.md b/.changeset/merge-tree-settings-block-columns.md deleted file mode 100644 index 766428e3b..000000000 --- a/.changeset/merge-tree-settings-block-columns.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch -'@hyperdx/common-utils': patch ---- - -feat: fall back to server MergeTree settings to detect persisted `_block_number` and `_block_offset` columns when the table's CREATE query omits them diff --git a/.changeset/metadata-columns-cache-ttl.md b/.changeset/metadata-columns-cache-ttl.md deleted file mode 100644 index 4a8b98db6..000000000 --- a/.changeset/metadata-columns-cache-ttl.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch -'@hyperdx/api': patch ---- - -fix: refresh cached table columns after 5 minutes - -The shared metadata cache kept each table's `DESCRIBE` result for the life of -the process, so the API did not see columns added with `ALTER TABLE`, such as -new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 -minutes. Other cached metadata is unchanged. diff --git a/.changeset/metric-no-recorded-value.md b/.changeset/metric-no-recorded-value.md deleted file mode 100644 index a123d3f68..000000000 --- a/.changeset/metric-no-recorded-value.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch -'@hyperdx/api': patch ---- - -fix: leave metric points with no recorded value out of charts and alerts - -When a scraped series goes away or a scrape fails, the collector's `prometheus` -receiver sends a point flagged "no recorded value" (a Prometheus staleness -marker), and the ClickHouse exporter stores it as zeros. Metric charts and -alerts read it as a real value: a gauge's `min` and `avg` dropped and `count` -included the series that went away, and a counter or histogram that came back -after the marker counted its whole total again. Metric queries now skip points -with this flag. diff --git a/.changeset/next-font-extensionless-urls.md b/.changeset/next-font-extensionless-urls.md deleted file mode 100644 index 43ae811e6..000000000 --- a/.changeset/next-font-extensionless-urls.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: bump next to 16.4.3 so builds no longer fail intermittently when Google Fonts returns extensionless font URLs diff --git a/.changeset/one-name-when-alerting-a-new-search.md b/.changeset/one-name-when-alerting-a-new-search.md deleted file mode 100644 index 534b9af51..000000000 --- a/.changeset/one-name-when-alerting-a-new-search.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Creating an alert from the search page asks for one name, not two. An unsaved search is named once in the alert modal's header and the alert inherits that name and its tags; on a saved search the alert's own name field is labelled "Alert name" and shows the inherited name as its placeholder instead of pre-filling a duplicate. diff --git a/.changeset/prometheus-proxy-basic-auth.md b/.changeset/prometheus-proxy-basic-auth.md deleted file mode 100644 index b4ecfc59e..000000000 --- a/.changeset/prometheus-proxy-basic-auth.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: Authenticate to Prometheus connections whose host includes credentials - -A Prometheus connection host such as `http://user:pass@prometheus:9090` made every PromQL query fail with "Failed to reach Prometheus", because `fetch` rejects URLs that carry credentials. The credentials are now sent as a Basic auth header. diff --git a/.changeset/reject-promql-tile-alerts.md b/.changeset/reject-promql-tile-alerts.md deleted file mode 100644 index 03c8dc66f..000000000 --- a/.changeset/reject-promql-tile-alerts.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -'@hyperdx/api': patch -'@hyperdx/common-utils': patch ---- - -fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL -tiles, and builder tiles with unsupported display types), and drop them when a -dashboard is saved diff --git a/.changeset/remember-collapsed-pinned-filters.md b/.changeset/remember-collapsed-pinned-filters.md deleted file mode 100644 index 2b7d8084b..000000000 --- a/.changeset/remember-collapsed-pinned-filters.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: A pinned filter collapsed in the search sidebar stays collapsed the next -time the source loads, instead of always opening diff --git a/.changeset/remove-brand-themes.md b/.changeset/remove-brand-themes.md deleted file mode 100644 index 1440afbdd..000000000 --- a/.changeset/remove-brand-themes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': minor ---- - -The app always uses ClickStack branding. Brand selection, the HyperDX palette, and the font picker are removed. Light, dark, and system color mode stay in Preferences. diff --git a/.changeset/replay-chunks-across-page-loads.md b/.changeset/replay-chunks-across-page-loads.md deleted file mode 100644 index d02cf352f..000000000 --- a/.changeset/replay-chunks-across-page-loads.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: keep session replay events from different page loads apart - -Browser SDKs up to `@clickhouse/clickstack-browser` 1.2.0 number replay events -from 1 again on every page load. When a page closed before all chunks of a large -event were sent, its leftover chunk could be joined with a later page's event of -the same number. That page's snapshot then failed to parse and did not render. -Chunks are now grouped by event number and full-precision timestamp, and replay -rows are ordered by the full-precision timestamp, so rows of two page loads in -the same second no longer interleave. - -The app's own browser telemetry now uses `@clickhouse/clickstack-browser` 1.2.1, -whose replay event numbers no longer repeat across page loads. diff --git a/.changeset/row-lookup-requires-both-block-columns.md b/.changeset/row-lookup-requires-both-block-columns.md deleted file mode 100644 index bf8d093bf..000000000 --- a/.changeset/row-lookup-requires-both-block-columns.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: only use the key-only row details lookup when the table persists both `_block_number` and `_block_offset`. A lone block column (e.g. a server-wide `enable_block_offset_column`) is not unique with a second-precision primary key and could open the wrong row; it is now only added as a tiebreaker to the full-row lookup. diff --git a/.changeset/row-panel-loading-state.md b/.changeset/row-panel-loading-state.md deleted file mode 100644 index 413a85d21..000000000 --- a/.changeset/row-panel-loading-state.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: show a loader while row details load - -Expanded search rows and the trace viewer's span details showed "Empty" or "No -body for this event." while the row was still loading. They now show a loader -until the row arrives. diff --git a/.changeset/row-side-panel-single-fetch.md b/.changeset/row-side-panel-single-fetch.md deleted file mode 100644 index 581ad0c28..000000000 --- a/.changeset/row-side-panel-single-fetch.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: run the row details query once when opening a row - -The side panel ran the same `SELECT *` row query twice: once for the panel, and -again when its Overview or Column Values tab mounted. A row that was found is -now reused from the cache, so the tab and later tab switches do not query it -again. A different row or source still runs the query, and a row that was not -found is looked up again. diff --git a/.changeset/session-id-columns-severity-text.md b/.changeset/session-id-columns-severity-text.md deleted file mode 100644 index b92efb96b..000000000 --- a/.changeset/session-id-columns-severity-text.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -'@hyperdx/otel-collector': patch ---- - -feat: session ID columns, `session.id` from `rum.sessionId`, severity text - -The `hyperdx_sessions` seed adds materialized `rum.sessionId` and `session.id` -columns with skip indexes, and the `otel_logs` seed adds a materialized -`session.id` column with a skip index, so session queries no longer read the -attribute maps. Only newly created tables get them; existing tables need an -`ALTER TABLE ... ADD COLUMN` to benefit. - -Spans, logs and session replay events from older `@hyperdx/browser` SDKs, which -carry the session id only in the `rum.sessionId` resource attribute, now also -get the OpenTelemetry `session.id` attribute. An existing `session.id` is never -overwritten and `rum.sessionId` is kept. If you override pipeline `processors:` -lists in `CUSTOM_OTELCOL_CONFIG_FILE`, add `transform/session_id` to keep this. - -Logs that carry a severity number but no severity text, such as those from the -new browser SDK, now get the matching level text (`info`, `error`, ...) instead -of an empty level. Severity text set by the producer is never overwritten. diff --git a/.changeset/shared-merge-tree-settings.md b/.changeset/shared-merge-tree-settings.md deleted file mode 100644 index 4c1e0e693..000000000 --- a/.changeset/shared-merge-tree-settings.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch -'@hyperdx/common-utils': patch ---- - -feat: on ClickHouse Cloud, read `system.shared_merge_tree_settings` when detecting `_block_number` and `_block_offset` columns, falling back to `system.merge_tree_settings` per key diff --git a/.changeset/sidebar-wordmark-text.md b/.changeset/sidebar-wordmark-text.md deleted file mode 100644 index 4ce27f9bb..000000000 --- a/.changeset/sidebar-wordmark-text.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): render the ClickStack name as text in the expanded sidebar, 8px from the logo symbol. diff --git a/.changeset/systeminformation-command-injection.md b/.changeset/systeminformation-command-injection.md deleted file mode 100644 index 3595354a1..000000000 --- a/.changeset/systeminformation-command-injection.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: update systeminformation to 5.33.19 - -The root `resolutions` pin let the lockfile keep systeminformation 5.30.7, which -has known command injection advisories, including two high-severity ones in -`networkInterfaces()` on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The -API installs it through `@opentelemetry/instrumentation-host-metrics`, which -asks for `^5.31.6`, but the old pin held it at 5.30.7. The pin now starts at -5.33.19, the newest 5.x release, which fixes all of them. diff --git a/.changeset/team-settings-separator-click-ui.md b/.changeset/team-settings-separator-click-ui.md deleted file mode 100644 index a857d9b53..000000000 --- a/.changeset/team-settings-separator-click-ui.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -refactor: use the click-ui `Separator` instead of the Mantine `Divider` in the -Team Settings sections. diff --git a/.changeset/time-ranges-label-lookup.md b/.changeset/time-ranges-label-lookup.md deleted file mode 100644 index e6b85ba44..000000000 --- a/.changeset/time-ranges-label-lookup.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/api': patch -'@hyperdx/common-utils': patch ---- - -fix: PromQL label lookups (dashboard variables, label autocomplete) now work on TimeSeries tables of schema version 8, the default from ClickHouse 26.10. These keep each series' time range in a separate time ranges table instead of the tags table's min_time/max_time, so match[] failed with "requires store_min_time_and_max_time = 1" and time-bounded lookups read the whole tags table. diff --git a/.changeset/time-zone-override.md b/.changeset/time-zone-override.md deleted file mode 100644 index 000c7dc14..000000000 --- a/.changeset/time-zone-override.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': minor ---- - -feat: Pick a time zone for the search and dashboard pages from the time picker, overriding the time zone in User Preferences. The picker shows the zone it uses, and the choice is kept in the URL and in links from charts and tables diff --git a/.changeset/trace-waterfall-browser-events.md b/.changeset/trace-waterfall-browser-events.md deleted file mode 100644 index 26be802d3..000000000 --- a/.changeset/trace-waterfall-browser-events.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -feat: Trace waterfall shows OpenTelemetry browser SDK request timings as dots on fetch and XHR spans, and the click that triggered a browser trace diff --git a/.changeset/update-favicon.md b/.changeset/update-favicon.md deleted file mode 100644 index 430940f57..000000000 --- a/.changeset/update-favicon.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix(app): use the new favicon set, including an SVG, in the browser tab, bookmarks, and touch icon. diff --git a/.changeset/uplot-posix-locale.md b/.changeset/uplot-posix-locale.md deleted file mode 100644 index 2b502a282..000000000 --- a/.changeset/uplot-posix-locale.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: The app no longer crashes on load in browsers that report a POSIX-style language such as `en-US@posix` diff --git a/.changeset/v2-alerts-list-filters.md b/.changeset/v2-alerts-list-filters.md deleted file mode 100644 index 98743b9b0..000000000 --- a/.changeset/v2-alerts-list-filters.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat: filter the v2 list alerts endpoint by tag, search, source and state diff --git a/.changeset/webhook-ssrf-dns-check.md b/.changeset/webhook-ssrf-dns-check.md deleted file mode 100644 index db0fd457a..000000000 --- a/.changeset/webhook-ssrf-dns-check.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: Block generic and incident.io webhooks whose hostname resolves to a private or reserved address. The check runs on the address actually dialed, so it also covers DNS rebinding. Self-hosted setups that send webhooks to internal hostnames must add them to `WEBHOOK_HOSTNAME_ALLOWLIST`. diff --git a/.env b/.env index 8ceaf87a8..ea338c969 100644 --- a/.env +++ b/.env @@ -9,8 +9,8 @@ NEXT_ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-all-in-one ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-all-in-one NEXT_OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-otel-collector OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-otel-collector -CODE_VERSION=2.43.1 -IMAGE_VERSION_SUB_TAG=.43.1 +CODE_VERSION=2.44.0 +IMAGE_VERSION_SUB_TAG=.44.0 IMAGE_VERSION=2 IMAGE_NIGHTLY_TAG=2-nightly IMAGE_LATEST_TAG=latest diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d71cc72f..52dced8c7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,365 @@ PR — keep the `hyperdx-release-notes` comment marker intact when editing so yo edits survive regeneration. Per-package detail lives in each `packages/*/CHANGELOG.md`. +## v2.44.0 — 2026-11-10 + + + +**Time zone picker and optional webhook emoji** + +You can now pick a time zone straight from the time picker on the search and +dashboard pages, overriding the one set in your User Preferences. Webhooks now +take an optional `titleEmoji` setting: set it to `false` and notification titles +sent through that webhook arrive without the emoji prefix. Columns added to a +ClickHouse table after HyperDX starts — a new MATERIALIZED column, say — are now +visible within five minutes, with no restart needed. Note before upgrading that +the app now always uses ClickStack branding — brand selection, the HyperDX +palette and the font picker are gone — that HyperDX instruments itself with +the ClickStack SDKs now, which changes the shape of its own telemetry and where +that telemetry goes by default, and that webhooks pointing at private or +reserved addresses are now blocked unless you allowlist their hostnames. + +### 💥 Breaking Changes + +- **ClickStack branding is now the only theme**: brand selection, the HyperDX + palette and the font picker have been removed, so the app always uses + ClickStack branding and its standard font. If you or your team had chosen the + HyperDX palette or a different font, that choice no longer applies. Light, + dark and system colour mode stay in Preferences. +- **Webhooks to private or reserved addresses are blocked**: generic and + incident.io webhooks whose hostname resolves to a private or reserved address + are now rejected, and the check runs on the address actually dialled, so it + also covers DNS rebinding. If your self-hosted setup notifies an internal + hostname, add it to `WEBHOOK_HOSTNAME_ALLOWLIST` before upgrading or those + notifications will stop going out. +- **HyperDX self-instruments with the ClickStack SDKs**: HyperDX's own telemetry + now comes from `@clickhouse/clickstack-node` and + `@clickhouse/clickstack-browser` in place of `@hyperdx/node-opentelemetry` and + `@hyperdx/browser`, and it changes shape. HTTP spans carry the stable semantic + convention keys (`http.request.method`, `http.response.status_code`, + `url.full`), pino records arrive under the + `@opentelemetry/instrumentation-pino` scope with real severity numbers instead + of the `node-logger` scope at severity number 0, console capture covers every + `console` call in the API, browser console output is recorded as log records + rather than spans, uncaught exceptions are recorded as FATAL log records, and + an API error is an exception event on the Express span instead of a separate + error span. Browser telemetry names the user as `user.id`, `user.email` and + `user.name` instead of `userEmail` and `userName`, keeps the team name as + `teamName`, no longer records a `user navigated` action, and no longer records + request and response headers or bodies on fetch and XHR spans; browser + sessions restart once after the upgrade. Update anything — a saved search, + alert or dashboard — keyed on the old attribute names before you upgrade. +- **Self-telemetry is configured with the OpenTelemetry variables**: + `HYPERDX_API_KEY` still enables self-instrumentation, but without + `OTEL_EXPORTER_OTLP_ENDPOINT` server-side self-telemetry now goes to + `http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the + endpoint explicitly. `HDX_NODE_*` variables are no longer read; capture + request headers and bodies with `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` + and `CLICKSTACK_CAPTURE_HTTP_BODY` instead. Browser traces and logs are now + sent gzip-compressed every 5 seconds, so if the browser sends to a collector + other than ClickStack's, that collector's CORS `allowed_headers` must be `"*"` + or include `content-type` and `content-encoding` (and `authorization`), and a + proxy in front of it must forward `Content-Encoding` unchanged. The per-signal + browser endpoints and `NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. +- **The Next.js server reports telemetry from production builds too**: with + `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` set, the Next.js server now + sends its own telemetry in production builds, not only under `next dev`. It + reports under its own service name — the configured one plus `-next` + (`hdx-oss-app-next` in the docker-compose `app` service and when no name is + set) — so its spans stay apart from the API's and the browser's, and the + HyperDX images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` + request gains Next.js server spans for the proxy hop, while requests for build + and `public/` assets such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*` + are not traced. `HDX_EXPORTER_ENABLED=false` turns it off along with browser + telemetry. + +### ✨ New Features + +- **Pick a time zone from the time picker**: the search and dashboard pages let + you choose the time zone they display, overriding the zone set in User + Preferences. The picker shows the zone it is using, and your choice is kept in + the URL and carried through links from charts and tables, so a shared link + opens in the same zone you were reading. +- **Emoji prefix in webhook titles is now optional**: webhooks take a new + `titleEmoji` option, and setting it to `false` sends notification titles + through that webhook without the leading emoji — useful where the receiving + system renders it poorly or your team would rather read a plain title. +- **Ad hoc dashboard filters can narrow their own suggestions**: an ad hoc + filter on a SQL source can now carry a SQL or Lucene "Keys and values filter", + much like a queried filter's dropdown values filter, limiting the rows its + keys and values are suggested from, and it can reference the dashboard's other + variables. While it points at a required filter with nothing selected, the ad + hoc filter won't add or edit conditions and names the filter it is waiting on, + and a suggestion lookup that fails now shows the database's error message. +- **Browser events on the trace waterfall and in the row side panel**: the + waterfall now plots the request timings an OpenTelemetry browser SDK records + as dots along fetch and XHR spans, and shows the click that triggered a + browser trace, so you can see where time went in the browser without leaving + the trace. The row side panel summarises the clicks, navigations and console + messages those SDKs record, and navigation rows no longer show an HTTP Request + section that never applied to them. +- **JavaScript stack traces broken into frames**: the Exception panel now parses + the JavaScript stack traces that OpenTelemetry SDKs report into individual + frames, with its own section for each `Caused by:` error, so you can follow an + exception and the errors behind it instead of reading one block of text. +- **Session IDs from older browser SDKs land on `session.id`**: spans, logs and + session replay events from older `@hyperdx/browser` SDKs carry the session id + only in the `rum.sessionId` resource attribute, and the collector now gives + them the OpenTelemetry `session.id` attribute as well, so anything keyed off + the standard attribute sees them too. An existing `session.id` is never + overwritten and `rum.sessionId` is kept; if you override pipeline + `processors:` lists in `CUSTOM_OTELCOL_CONFIG_FILE`, add `transform/session_id` + to keep this. Newly created `hyperdx_sessions` and `otel_logs` tables also get + `MATERIALIZED` session id columns with skip indexes, so session queries no + longer read the attribute maps — existing tables need an + `ALTER TABLE ... ADD COLUMN` to benefit. +- **Filter the v2 list alerts endpoint**: the v2 API for listing alerts now + accepts tag, search, source and state filters, so you can ask for just the + alerts you care about rather than fetching them all and filtering yourself. +- **Describe any table over MCP**: the new `clickstack_describe_table` tool + lists the tables in a database and describes one that is not a registered + source — its columns, keys, engine, skipping indices, approximate size and an + optional row sample — so an assistant can look into data you have not set up + as a source yet. +- **Set a dashboard's saved filter values over MCP**: the MCP dashboard tools + can now set a dashboard's `savedFilterValues`, so an assistant building or + updating a dashboard can leave its filters pre-filled rather than having you + set them by hand afterwards. +- **Run up to ten MCP SQL queries in parallel**: `clickstack_sql` now accepts a + `queries` array and runs up to ten independent queries at once under a shared + 60 second deadline, with each query reporting its own `ok`, `error` or + `timeout` status so one failure does not take the others down with it. + Single-query calls using `sql` behave exactly as before. +- **Narrower MCP table queries**: `clickstack_table` now takes an optional + `limit` and `having`, so an assistant can cut a grouped result down to the + rows worth reading rather than filtering them afterwards. Grouped results with + no `orderBy` now come back ordered by the first select item, descending, which + puts the largest values first instead of leaving the order to ClickHouse. + +### 🧪 Experimental + +PromQL support is gated behind the `ENABLE_PROMQL` flag; these changes apply +once it is on. + +- **PromQL sources and tiles over MCP**: `clickstack_describe_source` now + returns a PromQL source's label names and metric names — from a ClickHouse + TimeSeries table or a Prometheus-compatible endpoint — instead of a column + schema, and both it and `clickstack_list_sources` say which backend the source + uses, explaining how to read a TimeSeries table with `clickstack_sql`. + Prometheus endpoint sources no longer show a placeholder table, and the MCP + dashboard tools read and write PromQL tiles and `PROMETHEUS_LABEL` filters. + With `ENABLE_PROMQL` off, MCP hides PromQL sources from listing, describing + and deleting, `clickstack_save_source` no longer accepts `kind: "promql"`, and + the dashboard tools hide PromQL tiles rather than discarding them, so a + dashboard edited through MCP keeps its PromQL tiles intact. +- **Run a PromQL query over MCP**: the new `clickstack_promql` tool runs PromQL + against a PromQL source, and the MCP prompts and instructions now cover + PromQL sources, tiles and label filters while PromQL is enabled, so an + assistant knows how to reach them. Label lookups and queries also refuse a + Prometheus endpoint response over 8 MB rather than buffering the whole thing + into memory. +- **Query a PromQL tile over MCP**: the `query_tile` and `query_tiles` tools now + run PromQL tiles as well, against both Prometheus-compatible endpoints and + ClickHouse TimeSeries tables, so an assistant can read the numbers behind a + PromQL tile rather than only its definition. PromQL table and histogram + heatmap tiles come back in the rows the dashboard itself draws, so what the + assistant reads matches what you see on the dashboard. + +### 🔧 Improvements + +- **The ClickStack hexagon and bolt mark across the app**: the logo, the + collapsed nav and the favicon now carry the ClickStack hexagon and bolt mark, + so the browser tab and the sidebar match the branding the rest of the app + uses. The expanded sidebar spells out the ClickStack name as text beside the + symbol, and a new favicon set, an SVG included, covers the browser tab, + bookmarks and touch icon. +- **A tighter trace side panel**: the trace waterfall starts higher up the + panel, because a span no longer repeats its name in a box under the panel + title or shows its service as a chip beside the metadata row that already + names it, and the "⌘/Ctrl + scroll to zoom" hint has moved into the timeline's + top-left corner instead of claiming a row of its own. Span names too long for + the title keep their box, and log panels are unchanged. +- **Opening a row queries it once**: the side panel ran the same `SELECT *` row + query twice, once for the panel and again when its Overview or Column Values + tab mounted. A row that was found is now reused from the cache, so that tab + and later tab switches do not query it again; a different row or source still + runs the query, and a row that was not found is looked up again. +- **One name when you alert on a search**: creating an alert from the search + page now asks for a single name rather than two. An unsaved search is named + once in the alert modal's header and the alert inherits that name and its + tags; on a saved search the alert's own field is labelled "Alert name" and + shows the inherited name as its placeholder instead of pre-filling a + duplicate. +- **Collapsed pinned filters stay collapsed**: a pinned filter you collapse in + the search sidebar stays collapsed the next time that source loads, instead of + opening again every time. +- **Better compression for newly created tables**: the collector's seed schemas + now pin `ZSTD(3)` rather than `ZSTD(1)`, which compresses your data further + for a small insert-time CPU cost and no change to read performance. Only + tables created from here on are affected; existing tables keep the codecs they + already have. +- **Logs with a severity number but no severity text get a level**: logs that + arrive with a severity number and an empty severity text, such as those from + the new browser SDK, now get the matching level text (`info`, `error`, and so + on), so they read and filter like every other log. Severity text set by the + producer is never overwritten. +- **Browsers cache the collector's CORS preflights for 10 minutes**: the OTLP + receiver now answers preflight requests with `Access-Control-Max-Age: 600`. + Browsers previously cached a preflight for only 5 seconds, which is exactly + how often the browser SDK exports, so about half of its requests to the + collector were preflights. +- **Persisted `_block_number` and `_block_offset` columns detected more + reliably**: when a table's `CREATE` query omits them, HyperDX now falls back to + the server's MergeTree settings to work out whether they are persisted — + reading `system.shared_merge_tree_settings` first on ClickHouse Cloud, then + `system.merge_tree_settings` per key — so the features that rely on those + columns keep working on tables where the setting is applied server-side rather + than spelled out in the schema. +- **Sharper query guidance for MCP agents**: the MCP tool descriptions and the + query guide now recommend the quoted Lucene form `field:"value"` for exact + matches, and bare terms or phrases for log body text, so the queries an + assistant writes still make use of the primary key and the text index. +- **`minAutoGranularity` documented in the external API**: `GET`, `POST` and + `PUT /api/v2/sources` already accepted and returned `minAutoGranularity` on + metric and PromQL sources, but the OpenAPI spec left it out, so clients + generated from the spec dropped or rejected the field. The spec now documents + it, and generated clients can set and read it like any other source setting. + +### 🐛 Bug Fixes + +- **Metric points with no recorded value stay out of charts and alerts**: when a + scraped series goes away or a scrape fails, the collector's `prometheus` + receiver sends a point flagged "no recorded value" — a Prometheus staleness + marker — and the ClickHouse exporter stores it as zeros. Charts and alerts + read that as a real measurement, so a gauge's `min` and `avg` dropped and its + `count` still included the series that had gone, and a counter or histogram + that came back after the marker counted its whole total over again. Metric + queries now skip points carrying the flag. +- **Cached table columns refresh after 5 minutes**: the metadata cache kept each + table's `DESCRIBE` result for the life of the process, so columns added with + `ALTER TABLE`, such as new MATERIALIZED columns, were not picked up until the + API restarted. Cached columns now expire after 5 minutes; other cached + metadata is unchanged. +- **Alerts can no longer be set on tiles that never fire**: dashboard tiles the + alert checker does not evaluate — PromQL tiles, and builder tiles with an + unsupported display type — now reject alerts outright, instead of accepting + one that stayed silent forever. Any such alert already saved is dropped the + next time its dashboard is saved, so move it to a tile the checker supports if + you were relying on it. +- **Resolved grouped alerts name the group that resolved**: when a group + vanishes from the data, the alert resolves with that group's values filled in + for `{{attributes.*}}` in the title and message, and `{{var.*}}` in the webhook + body, so you can tell from the notification which group went quiet. +- **Row detail lookups work on FIPS ClickHouse and with special characters in + JSON keys**: looking up a JSON row no longer relies on MD5, which FIPS-enabled + deployments refuse to run — the lookup uses SHA256 instead — and path segments + containing special characters, a key prefixed with `@`, say, now stay quoted. + Row details and drill-down return the row rather than failing or reading the + key as something else. +- **Row details no longer open the wrong row on tables with a single block + column**: the key-only lookup is used only where a table persists both + `_block_number` and `_block_offset`. One block column on its own — from a + server-wide `enable_block_offset_column`, say — is not unique against a + second-precision primary key and could open a different row, so it is now + added only as a tiebreaker to the full-row lookup. +- **Row details show a loader while they load**: expanded search rows and the + trace viewer's span details read "Empty" or "No body for this event." while + the row was still on its way, which looked like a row with nothing in it. Both + now show a loader until the row arrives. +- **Session replays from separate page loads no longer collide**: browser SDKs + up to `@clickhouse/clickstack-browser` 1.2.0 number replay events from 1 again + on every page load, so when a page closed before all the chunks of a large + event were sent, its leftover chunk could be joined onto a later page's event + of the same number — that snapshot then failed to parse and never rendered. + Chunks are now grouped by event number and full-precision timestamp, and + replay rows are ordered by that timestamp, so rows from two page loads in the + same second no longer interleave. The app's own browser telemetry moves to + `@clickhouse/clickstack-browser` 1.2.1, whose replay event numbers no longer + repeat across page loads. +- **Legacy `STATUS_CODE_ERROR` spans count as errors on the service map and + trace waterfall**: spans from collectors that emit the long status form were + not recognised as errored in either view, so both undercounted errors. That + value is now counted alongside the short `Error` form. +- **Prometheus connections with credentials in the host work again**: a host + such as `http://user:pass@prometheus:9090` failed every PromQL query with + "Failed to reach Prometheus", because `fetch` rejects URLs carrying + credentials. Those credentials are now sent as a Basic auth header instead. +- **PromQL label lookups work on ClickHouse 26.10's TimeSeries tables**: schema + version 8, the default from ClickHouse 26.10, keeps each series' time range in + a separate time ranges table rather than in the tags table's + `min_time`/`max_time`, so dashboard variables and label autocomplete failed + with "requires store_min_time_and_max_time = 1" and time-bounded lookups read + the whole tags table. Those lookups now read the time ranges table, so they + resolve on version 8 tables and stay bounded by the window you asked for. +- **Saving a search no longer reloads the page**: the newly saved search opens + with a client-side navigation instead of a full page load, which also fixes + the 404 this caused on the static ClickStack build. +- **The sidebar toggle works on narrow screens**: on compact viewports the + toggle did nothing at all. It now opens the full nav as an overlay over the + page, so you can reach every section without widening the window. +- **The app loads in browsers reporting a POSIX-style language**: a browser + whose language reads as something like `en-US@posix` crashed the app on load. + Those locales are handled now, so the app starts as it should. +- **Dashboards and saved searches keep their team and owner**: a PATCH request + that included `team` or `createdBy` could move a dashboard or saved search to + another team, or rewrite who owned it. Both fields are now ignored on update, + so neither can be changed that way. +- **Event pattern drill-downs return the events they describe**: each pattern + from `clickstack_event_patterns` now carries a SQL `whereSnippet` that keeps + the template's token order and variable positions and includes both the + caller's filter and the source table filter, so handing it to + `clickstack_search` returns that pattern's events. Previously a template like + `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and + map fields produced Lucene that would not parse. Patterns can also be mined + from a key inside a JSON body, and the tool now reports its sample coverage + and the trend bucket interval and boundaries it actually used. + `clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard + event-pattern tiles also apply the log source's `tableFilterExpression` now, + so their counts can drop for sources that set one, and each cluster is + reported with its own template rather than occasionally that of a different + cluster of the same length. +- **Oversized MCP responses keep more of what you asked for**: a response over + the size budget now shortens a long string with a `…(+N chars)` suffix instead + of replacing it outright, and records what it cut in `trimNotes`. + `clickstack_event_patterns` and `clickstack_emerging_signals` drop samples and + shorten long patterns before they discard whole patterns, so the `topN` you + asked for survives wherever it can. + +### 📦 Build / Packaging + +- **systeminformation updated past its command injection advisories**: the API + pulls systeminformation in through + `@opentelemetry/instrumentation-host-metrics`, but the root `resolutions` pin + held the lockfile at 5.30.7, which carries known command injection advisories + — among them two high-severity ones in `networkInterfaces()` on Linux + (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The pin now starts at 5.33.19, the + newest 5.x release, which fixes all of them. +- **The app image is now published as `clickhouse/clickstack` as well**: the + HyperDX image goes out under `clickhouse/clickstack` alongside the existing + `hyperdx/hyperdx`, matching the other `clickhouse/clickstack-*` images, so you + can pull it under either name. Release workflows no longer log in to ghcr.io, + which was receiving no pushes. +- **Project links and the bundled compose file point at ClickStack**: the GitHub + links the app and packages carry — changelog, support and package metadata — + now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app + image as `clickhouse/clickstack`. +- **App builds no longer fail on extensionless Google Fonts URLs**: the app + moves to Next.js 16.4.3, fixing the intermittent build failures that happened + when Google Fonts returned a font URL without a file extension. Only builds of + the app from source are affected. + + + +### 📦 Package changelogs + +- `@hyperdx/api` 2.43.1 → 2.44.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/api/CHANGELOG.md#2440) +- `@hyperdx/app` 2.43.1 → 2.44.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/app/CHANGELOG.md#2440) +- `@hyperdx/cli` 0.8.0 → 0.8.1 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/cli/CHANGELOG.md#081) +- `@hyperdx/common-utils` 0.33.0 → 0.34.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/common-utils/CHANGELOG.md#0340) +- `@hyperdx/otel-collector` 2.43.1 → 2.44.0 — [changelog](https://github.com/ClickHouse/ClickStack/blob/main/packages/otel-collector/CHANGELOG.md#2440) + + + ## v2.43.1 — 2026-10-31 diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md index 141ea376a..ea6c07b99 100644 --- a/packages/api/CHANGELOG.md +++ b/packages/api/CHANGELOG.md @@ -1,5 +1,146 @@ # @hyperdx/api +## 2.44.0 + +### Minor Changes + +- cd0e9edfa: feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook +- 5b0d07441: feat: self-instrument with `@clickhouse/clickstack-node` and + `@clickhouse/clickstack-browser` instead of `@hyperdx/node-opentelemetry` and + `@hyperdx/browser` + + HyperDX's own telemetry changes shape. HTTP spans use the stable semantic + convention keys (`http.request.method`, `http.response.status_code`, + `url.full`). pino records come from the `@opentelemetry/instrumentation-pino` + scope with real severity numbers instead of the `node-logger` scope with + severity number 0. Console capture covers every `console` call in the API, and + browser console output is recorded as log records instead of spans. Uncaught + exceptions are recorded as FATAL log records, and API errors as an exception + event on the Express span instead of a separate error span. + + Browser telemetry records the user as `user.id`, `user.email` and `user.name` + instead of `userEmail` and `userName`, keeps the team name as `teamName`, and no + longer records a `user navigated` action. Browser fetch and XHR spans no longer + record request and response headers or bodies. Browser sessions restart once + after the upgrade. The per-signal browser endpoints and + `NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. Browser traces and logs + are now sent gzip-compressed every 5 seconds. If the browser sends to a + collector other than ClickStack's, its CORS `allowed_headers` must be `"*"` or + include `content-type` and `content-encoding` (and `authorization`), and a proxy + in front of it must forward `Content-Encoding` unchanged. + + The Next.js server now sends its own telemetry in production builds too, not + only under `next dev`, when `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` is + set. `HDX_EXPORTER_ENABLED=false` turns it off along with browser telemetry. It + reports under its own service name, the configured one plus `-next` + (`hdx-oss-app-next` in the docker-compose `app` service and when no name is + set), so its spans stay apart from the API's and the browser's. The HyperDX + images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` request + adds Next.js server spans for the proxy hop. Requests for build and `public/` + assets, such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*`, are not traced. + + `HYPERDX_API_KEY` still enables self-instrumentation. Without + `OTEL_EXPORTER_OTLP_ENDPOINT`, server-side self-telemetry now goes to + `http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the + endpoint explicitly. `HDX_NODE_*` variables are no longer read. For request + headers and bodies set `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` and + `CLICKSTACK_CAPTURE_HTTP_BODY`. + +- 349fc2141: feat(mcp): add `clickstack_describe_table` to list the tables in a database and describe a table that is not a registered source (columns, keys, engine, skipping indices, approximate size, optional row sample) +- 0eec5e140: feat: Describe PromQL sources in MCP and hide them when PromQL is disabled + + `clickstack_describe_source` now returns the label names and metric names of a PromQL source, from either a ClickHouse TimeSeries table or a Prometheus-compatible endpoint, instead of a column schema. `clickstack_list_sources` and `clickstack_describe_source` show which backend a PromQL source uses, and for TimeSeries tables explain how to read them with `clickstack_sql`. Prometheus endpoint sources no longer show their placeholder table. When `ENABLE_PROMQL` is off, MCP hides PromQL sources from listing, describing and deleting, and `clickstack_save_source` no longer accepts `kind: "promql"`. + +- 95fa36412: feat(mcp): support setting a dashboard's `savedFilterValues` via the MCP dashboard tools +- c792850fd: feat: filter the v2 list alerts endpoint by tag, search, source and state + +### Patch Changes + +- 30b1494d8: feat: add an internal extension point for alert detection strategies; threshold alerts are evaluated as before, and the `alerts.evaluate` metric now carries an `alert_evaluator` attribute +- 0453aa134: fix: A grouped alert whose group vanishes from the data now resolves with the group's values in `{{attributes.*}}` (alert title and message) and `{{var.*}}` (webhook body) +- 5b0d07441: fix: let browsers cache the collector's CORS preflights for 10 minutes + + The OTLP receiver now answers preflights with `Access-Control-Max-Age: 600`. + Without it, browsers cached a preflight for only 5 seconds, which is how often + the browser SDK exports, so about half of its requests were preflights. + +- 769c0def3: fix: ignore `team` and `createdBy` in dashboard and saved search PATCH bodies so they can't be moved to another team or have their owner rewritten +- 48c83790a: docs: Document `minAutoGranularity` on metric and PromQL sources in the external + API + + `GET`, `POST` and `PUT /api/v2/sources` already accepted and returned + `minAutoGranularity`, but the OpenAPI spec omitted it, so clients generated from + the spec dropped or rejected the field. + +- 5584f84bb: fix: make clickstack_event_patterns drill-down snippets executable + + Each pattern's `whereSnippet` is now a SQL predicate (`whereLanguage: "sql"`) that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to `clickstack_search` returns the pattern's events. Before, a template like `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and map fields produced Lucene that failed to parse. `bodyExpression` now also accepts `JSONExtractString(, '', ...)` to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries. + + `clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard event-pattern tiles now apply the log source's `tableFilterExpression`, so their counts can drop for sources that set one. `minePatterns` now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit. + +- 253a690d4: docs: MCP tool descriptions and the query guide now recommend the quoted Lucene + form `field:"value"` for exact matches, and bare terms or phrases for log body + text, so agents keep the primary key and the text index +- 66e394136: feat: MCP `query_tile` and `query_tiles` run PromQL tiles against Prometheus endpoints and ClickHouse TimeSeries tables +- 7e8522914: feat: MCP `clickstack_promql` tool runs PromQL against a PromQL source, and the MCP prompts and instructions cover PromQL sources, tiles and label filters while PromQL is enabled +- 9093282e5: fix: Refuse Prometheus endpoint responses over 8 MB in MCP PromQL label lookups and queries, instead of buffering them whole +- 53bf54096: fix: MCP `query_tile` returns PromQL table and histogram heatmap tiles in the rows the dashboard draws +- 917c9ca49: feat: MCP dashboard tools read and write PromQL tiles and PROMETHEUS_LABEL filters when PromQL is enabled, and hide but keep them when it is disabled +- d08b2fa73: feat(mcp): `clickstack_sql` accepts a `queries` array to run up to 10 + independent queries in parallel under a shared 60s deadline. Each query reports + its own `ok`/`error`/`timeout` status, so one failing query does not fail the + others. Single-query calls with `sql` behave as before. +- a13c80efe: feat(mcp): `clickstack_table` takes optional `limit` and `having`, and orders grouped results by the first select item, descending, when no `orderBy` is given +- 0262822da: fix: MCP tool responses that are over the size budget now shorten long strings with a `…(+N chars)` suffix instead of replacing them, say what was trimmed in `trimNotes`, and `clickstack_event_patterns` / `clickstack_emerging_signals` drop samples and shorten long patterns before cutting whole patterns, so the requested `topN` survives when it can +- 442d6dfd9: fix: refresh cached table columns after 5 minutes + + The shared metadata cache kept each table's `DESCRIBE` result for the life of + the process, so the API did not see columns added with `ALTER TABLE`, such as + new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 + minutes. Other cached metadata is unchanged. + +- eb2439ed0: fix: leave metric points with no recorded value out of charts and alerts + + When a scraped series goes away or a scrape fails, the collector's `prometheus` + receiver sends a point flagged "no recorded value" (a Prometheus staleness + marker), and the ClickHouse exporter stores it as zeros. Metric charts and + alerts read it as a real value: a gauge's `min` and `avg` dropped and `count` + included the series that went away, and a counter or histogram that came back + after the marker counted its whole total again. Metric queries now skip points + with this flag. + +- 0eec5e140: fix: Authenticate to Prometheus connections whose host includes credentials + + A Prometheus connection host such as `http://user:pass@prometheus:9090` made every PromQL query fail with "Failed to reach Prometheus", because `fetch` rejects URLs that carry credentials. The credentials are now sent as a Basic auth header. + +- 0a5237e6c: fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL + tiles, and builder tiles with unsupported display types), and drop them when a + dashboard is saved +- b7b4d9579: fix: update systeminformation to 5.33.19 + + The root `resolutions` pin let the lockfile keep systeminformation 5.30.7, which + has known command injection advisories, including two high-severity ones in + `networkInterfaces()` on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The + API installs it through `@opentelemetry/instrumentation-host-metrics`, which + asks for `^5.31.6`, but the old pin held it at 5.30.7. The pin now starts at + 5.33.19, the newest 5.x release, which fixes all of them. + +- b1d4e60f8: fix: PromQL label lookups (dashboard variables, label autocomplete) now work on TimeSeries tables of schema version 8, the default from ClickHouse 26.10. These keep each series' time range in a separate time ranges table instead of the tags table's min_time/max_time, so match[] failed with "requires store_min_time_and_max_time = 1" and time-bounded lookups read the whole tags table. +- 90302c773: fix: Block generic and incident.io webhooks whose hostname resolves to a private or reserved address. The check runs on the address actually dialed, so it also covers DNS rebinding. Self-hosted setups that send webhooks to internal hostnames must add them to `WEBHOOK_HOSTNAME_ALLOWLIST`. +- Updated dependencies [142c9cc87] +- Updated dependencies [cd0e9edfa] +- Updated dependencies [e2754d203] +- Updated dependencies [22f824c6e] +- Updated dependencies [d0dd06fe8] +- Updated dependencies [5584f84bb] +- Updated dependencies [41b2b742a] +- Updated dependencies [442d6dfd9] +- Updated dependencies [eb2439ed0] +- Updated dependencies [0a5237e6c] +- Updated dependencies [78143c81a] +- Updated dependencies [b1d4e60f8] + - @hyperdx/common-utils@0.34.0 + ## 2.43.1 ## 2.43.0 diff --git a/packages/api/package.json b/packages/api/package.json index 0b8f2e9fe..4e7b639e4 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/api", - "version": "2.43.1", + "version": "2.44.0", "license": "MIT", "private": true, "engines": { @@ -23,7 +23,7 @@ "@clickhouse/clickstack-node": "^1.0.2", "@clickhouse/client-common": "1.23.0-head.fae5998.1", "@esm2cjs/p-queue": "^7.3.0", - "@hyperdx/common-utils": "^0.33.0", + "@hyperdx/common-utils": "^0.34.0", "@hyperdx/passport-local-mongoose": "^9.0.1", "@modelcontextprotocol/sdk": "^1.27.1", "@opentelemetry/api": "~1.9.1", diff --git a/packages/app/CHANGELOG.md b/packages/app/CHANGELOG.md index e5d45a4fb..49a5934e0 100644 --- a/packages/app/CHANGELOG.md +++ b/packages/app/CHANGELOG.md @@ -1,5 +1,182 @@ # @hyperdx/app +## 2.44.0 + +### Minor Changes + +- 142c9cc87: feat: narrow ad hoc dashboard filter suggestions with a condition + + An ad hoc filter on SQL sources can now carry a SQL or Lucene "Keys and values + filter", like a queried filter's dropdown values filter, that limits the rows + its keys and values are suggested from. It can reference the dashboard's other + variables. While it references a required filter with nothing selected, the ad + hoc filter can't add or edit conditions and names the filter it is waiting on. + Failed suggestions now show the database's error message. + +- cd0e9edfa: feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook +- 5b0d07441: feat: self-instrument with `@clickhouse/clickstack-node` and + `@clickhouse/clickstack-browser` instead of `@hyperdx/node-opentelemetry` and + `@hyperdx/browser` + + HyperDX's own telemetry changes shape. HTTP spans use the stable semantic + convention keys (`http.request.method`, `http.response.status_code`, + `url.full`). pino records come from the `@opentelemetry/instrumentation-pino` + scope with real severity numbers instead of the `node-logger` scope with + severity number 0. Console capture covers every `console` call in the API, and + browser console output is recorded as log records instead of spans. Uncaught + exceptions are recorded as FATAL log records, and API errors as an exception + event on the Express span instead of a separate error span. + + Browser telemetry records the user as `user.id`, `user.email` and `user.name` + instead of `userEmail` and `userName`, keeps the team name as `teamName`, and no + longer records a `user navigated` action. Browser fetch and XHR spans no longer + record request and response headers or bodies. Browser sessions restart once + after the upgrade. The per-signal browser endpoints and + `NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES` work as before. Browser traces and logs + are now sent gzip-compressed every 5 seconds. If the browser sends to a + collector other than ClickStack's, its CORS `allowed_headers` must be `"*"` or + include `content-type` and `content-encoding` (and `authorization`), and a proxy + in front of it must forward `Content-Encoding` unchanged. + + The Next.js server now sends its own telemetry in production builds too, not + only under `next dev`, when `HYPERDX_API_KEY` or `OTEL_EXPORTER_OTLP_HEADERS` is + set. `HDX_EXPORTER_ENABLED=false` turns it off along with browser telemetry. It + reports under its own service name, the configured one plus `-next` + (`hdx-oss-app-next` in the docker-compose `app` service and when no name is + set), so its spans stay apart from the API's and the browser's. The HyperDX + images now default `OTEL_SERVICE_NAME` to `hdx-oss-app`. Each `/api` request + adds Next.js server spans for the proxy hop. Requests for build and `public/` + assets, such as `/_next/static/*`, `/__ENV.js` and `/pyodide/*`, are not traced. + + `HYPERDX_API_KEY` still enables self-instrumentation. Without + `OTEL_EXPORTER_OTLP_ENDPOINT`, server-side self-telemetry now goes to + `http://localhost:4318` instead of `https://in-otel.hyperdx.io`, so set the + endpoint explicitly. `HDX_NODE_*` variables are no longer read. For request + headers and bodies set `OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_*` and + `CLICKSTACK_CAPTURE_HTTP_BODY`. + +- af17e8ff8: The app always uses ClickStack branding. Brand selection, the HyperDX palette, and the font picker are removed. Light, dark, and system color mode stay in Preferences. +- dd8c2e4b6: feat: Pick a time zone for the search and dashboard pages from the time picker, overriding the time zone in User Preferences. The picker shows the zone it uses, and the choice is kept in the URL and in links from charts and tables + +### Patch Changes + +- 7de661b6a: feat: Row side panel summarizes clicks, navigations and console messages from OpenTelemetry browser SDKs, and navigation rows no longer show an HTTP Request section +- ab36d4e13: feat: publish the HyperDX image as `clickhouse/clickstack` alongside + `hyperdx/hyperdx`, matching the other `clickhouse/clickstack-*` images. Release + workflows no longer log into ghcr.io, which received no pushes. +- f56d4ad5b: fix(app): use the ClickStack hexagon and bolt mark in the logo, the collapsed nav, and the favicon. +- d7df729e6: chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack` +- f56d4ad5b: fix(app): open the full nav over the page on compact viewports. On narrow screens the sidebar toggle now opens the full nav as an overlay instead of doing nothing. +- 513b23796: fix: start the trace waterfall higher in the side panel + + Trace spans no longer repeat their name in a box under the panel title, or the + service as a chip next to the metadata row that already shows it. The + "⌘/Ctrl + scroll to zoom" hint moves into the timeline's top-left corner + instead of taking its own row. Long span names that the title truncates keep + the box. Log panels keep their body box and service chip. + +- e2754d203: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row + details and drill-down work on FIPS-enabled ClickHouse deployments +- 5abf27ed3: Saving a search no longer reloads the page: the new saved search is opened with + a client-side navigation, which also fixes the 404 this caused on the static + ClickStack build. +- 04f55d12c: feat: Exception panel parses JavaScript stack traces from OpenTelemetry SDKs into frames, with a section per `Caused by:` error +- d0dd06fe8: fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace + waterfall +- 41b2b742a: feat: fall back to server MergeTree settings to detect persisted `_block_number` and `_block_offset` columns when the table's CREATE query omits them +- 442d6dfd9: fix: refresh cached table columns after 5 minutes + + The shared metadata cache kept each table's `DESCRIBE` result for the life of + the process, so the API did not see columns added with `ALTER TABLE`, such as + new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 + minutes. Other cached metadata is unchanged. + +- eb2439ed0: fix: leave metric points with no recorded value out of charts and alerts + + When a scraped series goes away or a scrape fails, the collector's `prometheus` + receiver sends a point flagged "no recorded value" (a Prometheus staleness + marker), and the ClickHouse exporter stores it as zeros. Metric charts and + alerts read it as a real value: a gauge's `min` and `avg` dropped and `count` + included the series that went away, and a counter or histogram that came back + after the marker counted its whole total again. Metric queries now skip points + with this flag. + +- 9df8b8d47: fix: bump next to 16.4.3 so builds no longer fail intermittently when Google Fonts returns extensionless font URLs +- ec0db7ac9: fix: Creating an alert from the search page asks for one name, not two. An unsaved search is named once in the alert modal's header and the alert inherits that name and its tags; on a saved search the alert's own name field is labelled "Alert name" and shows the inherited name as its placeholder instead of pre-filling a duplicate. +- 467c16792: feat: A pinned filter collapsed in the search sidebar stays collapsed the next + time the source loads, instead of always opening +- 6468dadcf: fix: keep session replay events from different page loads apart + + Browser SDKs up to `@clickhouse/clickstack-browser` 1.2.0 number replay events + from 1 again on every page load. When a page closed before all chunks of a large + event were sent, its leftover chunk could be joined with a later page's event of + the same number. That page's snapshot then failed to parse and did not render. + Chunks are now grouped by event number and full-precision timestamp, and replay + rows are ordered by the full-precision timestamp, so rows of two page loads in + the same second no longer interleave. + + The app's own browser telemetry now uses `@clickhouse/clickstack-browser` 1.2.1, + whose replay event numbers no longer repeat across page loads. + +- 86cd38b7e: fix: only use the key-only row details lookup when the table persists both `_block_number` and `_block_offset`. A lone block column (e.g. a server-wide `enable_block_offset_column`) is not unique with a second-precision primary key and could open the wrong row; it is now only added as a tiebreaker to the full-row lookup. +- 82b2104bb: fix: show a loader while row details load + + Expanded search rows and the trace viewer's span details showed "Empty" or "No + body for this event." while the row was still loading. They now show a loader + until the row arrives. + +- 3a412e4f8: fix: run the row details query once when opening a row + + The side panel ran the same `SELECT *` row query twice: once for the panel, and + again when its Overview or Column Values tab mounted. A row that was found is + now reused from the cache, so the tab and later tab switches do not query it + again. A different row or source still runs the query, and a row that was not + found is looked up again. + +- 78143c81a: feat: on ClickHouse Cloud, read `system.shared_merge_tree_settings` when detecting `_block_number` and `_block_offset` columns, falling back to `system.merge_tree_settings` per key +- 4e93ae500: fix(app): render the ClickStack name as text in the expanded sidebar, 8px from the logo symbol. +- 2bad9af17: refactor: use the click-ui `Separator` instead of the Mantine `Divider` in the + Team Settings sections. +- af75b2b59: feat: Trace waterfall shows OpenTelemetry browser SDK request timings as dots on fetch and XHR spans, and the click that triggered a browser trace +- 4e93ae500: fix(app): use the new favicon set, including an SVG, in the browser tab, bookmarks, and touch icon. +- dc58efde2: fix: The app no longer crashes on load in browsers that report a POSIX-style language such as `en-US@posix` +- Updated dependencies [142c9cc87] +- Updated dependencies [30b1494d8] +- Updated dependencies [0453aa134] +- Updated dependencies [cd0e9edfa] +- Updated dependencies [5b0d07441] +- Updated dependencies [5b0d07441] +- Updated dependencies [769c0def3] +- Updated dependencies [48c83790a] +- Updated dependencies [e2754d203] +- Updated dependencies [22f824c6e] +- Updated dependencies [d0dd06fe8] +- Updated dependencies [349fc2141] +- Updated dependencies [5584f84bb] +- Updated dependencies [253a690d4] +- Updated dependencies [66e394136] +- Updated dependencies [7e8522914] +- Updated dependencies [9093282e5] +- Updated dependencies [53bf54096] +- Updated dependencies [0eec5e140] +- Updated dependencies [917c9ca49] +- Updated dependencies [95fa36412] +- Updated dependencies [d08b2fa73] +- Updated dependencies [a13c80efe] +- Updated dependencies [0262822da] +- Updated dependencies [41b2b742a] +- Updated dependencies [442d6dfd9] +- Updated dependencies [eb2439ed0] +- Updated dependencies [0eec5e140] +- Updated dependencies [0a5237e6c] +- Updated dependencies [78143c81a] +- Updated dependencies [b7b4d9579] +- Updated dependencies [b1d4e60f8] +- Updated dependencies [c792850fd] +- Updated dependencies [90302c773] + - @hyperdx/common-utils@0.34.0 + - @hyperdx/api@2.44.0 + ## 2.43.1 ### Patch Changes diff --git a/packages/app/package.json b/packages/app/package.json index 6b005f96f..58b147685 100644 --- a/packages/app/package.json +++ b/packages/app/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/app", - "version": "2.43.1", + "version": "2.44.0", "private": true, "license": "MIT", "engines": { @@ -40,7 +40,7 @@ "@dnd-kit/utilities": "^3.2.2", "@hookform/resolvers": "^3.9.0", "@hyperdx/api": "workspace:*", - "@hyperdx/common-utils": "^0.33.0", + "@hyperdx/common-utils": "^0.34.0", "@mantine/core": "^9.0.0", "@mantine/dates": "^9.0.0", "@mantine/dropzone": "^9.0.0", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 270c917d9..e95357961 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,13 @@ # @hyperdx/cli +## 0.8.1 + +### Patch Changes + +- d7df729e6: chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack` +- e2754d203: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row + details and drill-down work on FIPS-enabled ClickHouse deployments + ## 0.8.0 ### Minor Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 24d75c885..62ea314c5 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/cli", - "version": "0.8.0", + "version": "0.8.1", "license": "MIT", "type": "module", "repository": { @@ -41,7 +41,7 @@ }, "devDependencies": { "@clickhouse/client": "1.23.0-head.fae5998.1", - "@hyperdx/common-utils": "^0.33.0", + "@hyperdx/common-utils": "^0.34.0", "@jest/globals": "^30.2.0", "@types/crypto-js": "^4.2.2", "@types/jest": "^29.5.14", diff --git a/packages/common-utils/CHANGELOG.md b/packages/common-utils/CHANGELOG.md index 58cc1c131..e71c6f729 100644 --- a/packages/common-utils/CHANGELOG.md +++ b/packages/common-utils/CHANGELOG.md @@ -1,5 +1,57 @@ # @hyperdx/common-utils +## 0.34.0 + +### Minor Changes + +- 142c9cc87: feat: narrow ad hoc dashboard filter suggestions with a condition + + An ad hoc filter on SQL sources can now carry a SQL or Lucene "Keys and values + filter", like a queried filter's dropdown values filter, that limits the rows + its keys and values are suggested from. It can reference the dashboard's other + variables. While it references a required filter with nothing selected, the ad + hoc filter can't add or edit conditions and names the filter it is waiting on. + Failed suggestions now show the database's error message. + +- cd0e9edfa: feat: add optional `titleEmoji` webhook option; `false` removes the emoji prefix from notification titles sent through that webhook + +### Patch Changes + +- e2754d203: fix: use SHA256 instead of MD5 for JSON row lookup WHERE clauses so row + details and drill-down work on FIPS-enabled ClickHouse deployments +- 22f824c6e: fix: keep JSON path segments with special characters quoted in row detail lookups +- d0dd06fe8: fix: count legacy STATUS_CODE_ERROR spans as errors on the service map and trace + waterfall +- 5584f84bb: fix: make clickstack_event_patterns drill-down snippets executable + + Each pattern's `whereSnippet` is now a SQL predicate (`whereLanguage: "sql"`) that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to `clickstack_search` returns the pattern's events. Before, a template like `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and map fields produced Lucene that failed to parse. `bodyExpression` now also accepts `JSONExtractString(, '', ...)` to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries. + + `clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard event-pattern tiles now apply the log source's `tableFilterExpression`, so their counts can drop for sources that set one. `minePatterns` now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit. + +- 41b2b742a: feat: fall back to server MergeTree settings to detect persisted `_block_number` and `_block_offset` columns when the table's CREATE query omits them +- 442d6dfd9: fix: refresh cached table columns after 5 minutes + + The shared metadata cache kept each table's `DESCRIBE` result for the life of + the process, so the API did not see columns added with `ALTER TABLE`, such as + new MATERIALIZED columns, until it restarted. Cached columns now expire after 5 + minutes. Other cached metadata is unchanged. + +- eb2439ed0: fix: leave metric points with no recorded value out of charts and alerts + + When a scraped series goes away or a scrape fails, the collector's `prometheus` + receiver sends a point flagged "no recorded value" (a Prometheus staleness + marker), and the ClickHouse exporter stores it as zeros. Metric charts and + alerts read it as a real value: a gauge's `min` and `avg` dropped and `count` + included the series that went away, and a counter or histogram that came back + after the marker counted its whole total again. Metric queries now skip points + with this flag. + +- 0a5237e6c: fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL + tiles, and builder tiles with unsupported display types), and drop them when a + dashboard is saved +- 78143c81a: feat: on ClickHouse Cloud, read `system.shared_merge_tree_settings` when detecting `_block_number` and `_block_offset` columns, falling back to `system.merge_tree_settings` per key +- b1d4e60f8: fix: PromQL label lookups (dashboard variables, label autocomplete) now work on TimeSeries tables of schema version 8, the default from ClickHouse 26.10. These keep each series' time range in a separate time ranges table instead of the tags table's min_time/max_time, so match[] failed with "requires store_min_time_and_max_time = 1" and time-bounded lookups read the whole tags table. + ## 0.33.0 ### Minor Changes diff --git a/packages/common-utils/package.json b/packages/common-utils/package.json index fb650e0b2..a7b8cd195 100644 --- a/packages/common-utils/package.json +++ b/packages/common-utils/package.json @@ -1,7 +1,7 @@ { "name": "@hyperdx/common-utils", "description": "Common utilities for HyperDX application", - "version": "0.33.0", + "version": "0.34.0", "license": "MIT", "private": true, "files": [ diff --git a/packages/otel-collector/CHANGELOG.md b/packages/otel-collector/CHANGELOG.md index 41470c522..566e6c9cc 100644 --- a/packages/otel-collector/CHANGELOG.md +++ b/packages/otel-collector/CHANGELOG.md @@ -1,5 +1,42 @@ # @hyperdx/otel-collector +## 2.44.0 + +### Patch Changes + +- 5b0d07441: fix: let browsers cache the collector's CORS preflights for 10 minutes + + The OTLP receiver now answers preflights with `Access-Control-Max-Age: 600`. + Without it, browsers cached a preflight for only 5 seconds, which is how often + the browser SDK exports, so about half of its requests were preflights. + +- 8384fe675: perf: compress the seed schemas with `ZSTD(3)` instead of `ZSTD(1)` + + The seed schemas pinned `ZSTD(1)` on almost every column. Level 3 gives a better + compression ratio at a small insert-time CPU cost, without affecting reads, and + it is the default codec of ClickHouse since 26.9. It is pinned explicitly so + that older ClickHouse versions, whose default is `LZ4`, get it too. `Delta` + codecs drop their byte-size argument, which ClickHouse infers from the column + type. Only newly created tables are affected; existing tables keep their codecs. + +- 702181002: feat: session ID columns, `session.id` from `rum.sessionId`, severity text + + The `hyperdx_sessions` seed adds materialized `rum.sessionId` and `session.id` + columns with skip indexes, and the `otel_logs` seed adds a materialized + `session.id` column with a skip index, so session queries no longer read the + attribute maps. Only newly created tables get them; existing tables need an + `ALTER TABLE ... ADD COLUMN` to benefit. + + Spans, logs and session replay events from older `@hyperdx/browser` SDKs, which + carry the session id only in the `rum.sessionId` resource attribute, now also + get the OpenTelemetry `session.id` attribute. An existing `session.id` is never + overwritten and `rum.sessionId` is kept. If you override pipeline `processors:` + lists in `CUSTOM_OTELCOL_CONFIG_FILE`, add `transform/session_id` to keep this. + + Logs that carry a severity number but no severity text, such as those from the + new browser SDK, now get the matching level text (`info`, `error`, ...) instead + of an empty level. Severity text set by the producer is never overwritten. + ## 2.43.1 ### Patch Changes diff --git a/packages/otel-collector/package.json b/packages/otel-collector/package.json index 8636220ca..62fcb6d9a 100644 --- a/packages/otel-collector/package.json +++ b/packages/otel-collector/package.json @@ -1,7 +1,7 @@ { "name": "@hyperdx/otel-collector", "description": "HyperDX OpenTelemetry Collector configuration and Docker image", - "version": "2.43.1", + "version": "2.44.0", "license": "MIT", "private": true } diff --git a/yarn.lock b/yarn.lock index 27fca23f3..ae2d02a9e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4772,7 +4772,7 @@ __metadata: "@clickhouse/clickstack-node": "npm:^1.0.2" "@clickhouse/client-common": "npm:1.23.0-head.fae5998.1" "@esm2cjs/p-queue": "npm:^7.3.0" - "@hyperdx/common-utils": "npm:^0.33.0" + "@hyperdx/common-utils": "npm:^0.34.0" "@hyperdx/passport-local-mongoose": "npm:^9.0.1" "@modelcontextprotocol/sdk": "npm:^1.27.1" "@opentelemetry/api": "npm:~1.9.1" @@ -4870,7 +4870,7 @@ __metadata: "@eslint/compat": "npm:^2.0.0" "@hookform/resolvers": "npm:^3.9.0" "@hyperdx/api": "workspace:*" - "@hyperdx/common-utils": "npm:^0.33.0" + "@hyperdx/common-utils": "npm:^0.34.0" "@mantine/core": "npm:^9.0.0" "@mantine/dates": "npm:^9.0.0" "@mantine/dropzone": "npm:^9.0.0" @@ -4988,7 +4988,7 @@ __metadata: resolution: "@hyperdx/cli@workspace:packages/cli" dependencies: "@clickhouse/client": "npm:1.23.0-head.fae5998.1" - "@hyperdx/common-utils": "npm:^0.33.0" + "@hyperdx/common-utils": "npm:^0.34.0" "@jest/globals": "npm:^30.2.0" "@types/crypto-js": "npm:^4.2.2" "@types/jest": "npm:^29.5.14" @@ -5015,7 +5015,7 @@ __metadata: languageName: unknown linkType: soft -"@hyperdx/common-utils@npm:^0.33.0, @hyperdx/common-utils@workspace:packages/common-utils": +"@hyperdx/common-utils@npm:^0.34.0, @hyperdx/common-utils@workspace:packages/common-utils": version: 0.0.0-use.local resolution: "@hyperdx/common-utils@workspace:packages/common-utils" dependencies: