From 586f07dde71a55cb443c2c14e2747219d71aea65 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 21:44:06 +0000 Subject: [PATCH 1/2] chore(release): bump HyperDX app/package versions --- .changeset/alert-update-not-found.md | 5 - .changeset/bright-dashboard-not-found.md | 5 - .changeset/chart-tooltip-focus-and-zindex.md | 7 -- .changeset/clear-stale-alert-source-fields.md | 5 - .changeset/cross-source-search-from-trace.md | 5 - .changeset/dashboard-replay-search.md | 5 - .../dashboard-time-chart-series-limit.md | 15 --- .../default-search-source-compatible.md | 5 - .changeset/emerging-signals-mcp-tool.md | 5 - .../escape-like-metacharacters-in-search.md | 10 -- .changeset/eval-deploy-regression-scenario.md | 5 - .../expose-series-limit-external-api.md | 5 - .changeset/fair-headers-buffer.md | 5 - ...ix-timepicker-zindex-over-chart-tooltip.md | 5 - .changeset/fuzzy-escaped-quotes.md | 5 - .changeset/heatmap-tooltip-percentile.md | 5 - .changeset/hide-histogram-agg-fns.md | 5 - .changeset/lucene-encode-all-url-tokens.md | 11 --- .changeset/mantine-theme-refinements.md | 10 -- ...etric-table-autofill-on-database-change.md | 5 - .changeset/metrics-v15-series-table.md | 7 -- .changeset/prominent-view-trace-action.md | 12 --- .changeset/query-exemplars-route.md | 27 ------ .changeset/range-open-exclusive-bounds.md | 12 --- .changeset/rate-limit-per-access-key.md | 11 --- .changeset/remember-side-panel-tab.md | 10 -- .changeset/root-changelog-whats-new.md | 6 -- .changeset/select-star-error-state.md | 5 - .../series-limit-groupby-and-compare-fixes.md | 12 --- .changeset/shorten-all-relative-time-units.md | 9 -- .../span-attributes-key-column-overlap.md | 5 - .changeset/team-invitation-scoping.md | 5 - .changeset/terraform-iac-helpers.md | 15 --- .../timestamp-type-detection-spellings.md | 12 --- .../view-trace-row-lookup-time-filter.md | 6 -- .env | 4 +- packages/api/CHANGELOG.md | 76 +++++++++++++++ packages/api/package.json | 4 +- packages/app/CHANGELOG.md | 97 +++++++++++++++++++ packages/app/package.json | 4 +- packages/cli/package.json | 2 +- packages/common-utils/CHANGELOG.md | 70 +++++++++++++ packages/common-utils/package.json | 2 +- packages/hdx-eval/CHANGELOG.md | 6 ++ packages/hdx-eval/package.json | 2 +- packages/otel-collector/CHANGELOG.md | 2 + packages/otel-collector/package.json | 2 +- yarn.lock | 8 +- 48 files changed, 265 insertions(+), 296 deletions(-) delete mode 100644 .changeset/alert-update-not-found.md delete mode 100644 .changeset/bright-dashboard-not-found.md delete mode 100644 .changeset/chart-tooltip-focus-and-zindex.md delete mode 100644 .changeset/clear-stale-alert-source-fields.md delete mode 100644 .changeset/cross-source-search-from-trace.md delete mode 100644 .changeset/dashboard-replay-search.md delete mode 100644 .changeset/dashboard-time-chart-series-limit.md delete mode 100644 .changeset/default-search-source-compatible.md delete mode 100644 .changeset/emerging-signals-mcp-tool.md delete mode 100644 .changeset/escape-like-metacharacters-in-search.md delete mode 100644 .changeset/eval-deploy-regression-scenario.md delete mode 100644 .changeset/expose-series-limit-external-api.md delete mode 100644 .changeset/fair-headers-buffer.md delete mode 100644 .changeset/fix-timepicker-zindex-over-chart-tooltip.md delete mode 100644 .changeset/fuzzy-escaped-quotes.md delete mode 100644 .changeset/heatmap-tooltip-percentile.md delete mode 100644 .changeset/hide-histogram-agg-fns.md delete mode 100644 .changeset/lucene-encode-all-url-tokens.md delete mode 100644 .changeset/mantine-theme-refinements.md delete mode 100644 .changeset/metric-table-autofill-on-database-change.md delete mode 100644 .changeset/metrics-v15-series-table.md delete mode 100644 .changeset/prominent-view-trace-action.md delete mode 100644 .changeset/query-exemplars-route.md delete mode 100644 .changeset/range-open-exclusive-bounds.md delete mode 100644 .changeset/rate-limit-per-access-key.md delete mode 100644 .changeset/remember-side-panel-tab.md delete mode 100644 .changeset/root-changelog-whats-new.md delete mode 100644 .changeset/select-star-error-state.md delete mode 100644 .changeset/series-limit-groupby-and-compare-fixes.md delete mode 100644 .changeset/shorten-all-relative-time-units.md delete mode 100644 .changeset/span-attributes-key-column-overlap.md delete mode 100644 .changeset/team-invitation-scoping.md delete mode 100644 .changeset/terraform-iac-helpers.md delete mode 100644 .changeset/timestamp-type-detection-spellings.md delete mode 100644 .changeset/view-trace-row-lookup-time-filter.md diff --git a/.changeset/alert-update-not-found.md b/.changeset/alert-update-not-found.md deleted file mode 100644 index 1eba3597ad..0000000000 --- a/.changeset/alert-update-not-found.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -Return 404 when updating a missing alert. diff --git a/.changeset/bright-dashboard-not-found.md b/.changeset/bright-dashboard-not-found.md deleted file mode 100644 index a365840672..0000000000 --- a/.changeset/bright-dashboard-not-found.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -Return a not-found response when updating a missing dashboard. diff --git a/.changeset/chart-tooltip-focus-and-zindex.md b/.changeset/chart-tooltip-focus-and-zindex.md deleted file mode 100644 index ce687327f4..0000000000 --- a/.changeset/chart-tooltip-focus-and-zindex.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -- Added a "Show All Series" button to clear a focused chart series -- Fixed chart tooltip action buttons rendering behind the tooltip -- Added a max height and scroll to the legend "+N more" list diff --git a/.changeset/clear-stale-alert-source-fields.md b/.changeset/clear-stale-alert-source-fields.md deleted file mode 100644 index a451912ec6..0000000000 --- a/.changeset/clear-stale-alert-source-fields.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -Clear stale source-specific alert references when changing alert source. diff --git a/.changeset/cross-source-search-from-trace.md b/.changeset/cross-source-search-from-trace.md deleted file mode 100644 index 610c00f1fa..0000000000 --- a/.changeset/cross-source-search-from-trace.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: SQL error when clicking "Search" on a log attached to a trace while in the Traces view diff --git a/.changeset/dashboard-replay-search.md b/.changeset/dashboard-replay-search.md deleted file mode 100644 index 5b6324f2b1..0000000000 --- a/.changeset/dashboard-replay-search.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@hyperdx/app": patch ---- - -feat(dashboards): add a Replay search action to log and trace dashboard tiles whose event query can be faithfully reconstructed. The action opens a new Search tab with the tile's source, query, filters, and dashboard time range preserved. diff --git a/.changeset/dashboard-time-chart-series-limit.md b/.changeset/dashboard-time-chart-series-limit.md deleted file mode 100644 index d10d9e27a2..0000000000 --- a/.changeset/dashboard-time-chart-series-limit.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@hyperdx/common-utils': minor -'@hyperdx/app': minor -'@hyperdx/api': minor ---- - -Cap high-cardinality time-chart series to protect the browser from rendering -thousands of lines at once. Time charts now materialize and draw a bounded -number of series per tile, with escape hatches to reveal the rest on demand: a -"+N more" affordance in the hover and pinned tooltips, and a "load all series" -action that lifts the cap for a chart. Tooltips also cap how many rows they -render per frame so a wide bucket can't mount thousands of popovers. The -external dashboards API exposes the per-tile series limit as a three-state value -across tile types — omit for the default cap, 0 for unlimited, or a positive N -for the top N diff --git a/.changeset/default-search-source-compatible.md b/.changeset/default-search-source-compatible.md deleted file mode 100644 index 3190dd5af5..0000000000 --- a/.changeset/default-search-source-compatible.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Prevent the search page from defaulting to an incompatible source kind diff --git a/.changeset/emerging-signals-mcp-tool.md b/.changeset/emerging-signals-mcp-tool.md deleted file mode 100644 index 4e788fc6ef..0000000000 --- a/.changeset/emerging-signals-mcp-tool.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@hyperdx/api": minor ---- - -feat(mcp): add `clickstack_emerging_signals` MCP tool — a two-window Drain pattern novelty detector that set-differences mined log/event patterns between an earlier baseline window and a current window to surface what is newly emerging or has disappeared. Shares the Drain sample-and-mine pipeline with `clickstack_event_patterns` via an extracted `mineWindowPatterns` helper, and keys patterns across windows with a `normalizeTemplate` helper. diff --git a/.changeset/escape-like-metacharacters-in-search.md b/.changeset/escape-like-metacharacters-in-search.md deleted file mode 100644 index 7dd9c10a9d..0000000000 --- a/.changeset/escape-like-metacharacters-in-search.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/common-utils': patch ---- - -Treat `_` and `%` in a search term as literal characters, not LIKE wildcards - -Search terms were interpolated straight into the ILIKE pattern, so ClickHouse -read their `_` and `%` as wildcards. `ServiceName:user_service` also matched -`user-service` and `user.service`, and the negated `-ServiceName:user_service` -dropped those same rows. Token-index lookups still receive the raw term. diff --git a/.changeset/eval-deploy-regression-scenario.md b/.changeset/eval-deploy-regression-scenario.md deleted file mode 100644 index 8cef59ba75..0000000000 --- a/.changeset/eval-deploy-regression-scenario.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@hyperdx/hdx-eval": patch ---- - -feat(evals): add deploy-regression scenario (metrics-neutral) — a checkout-api staged-rollout defect fully solvable from traces/logs, with corroborating-only metrics to measure organic metric-tool adoption diff --git a/.changeset/expose-series-limit-external-api.md b/.changeset/expose-series-limit-external-api.md deleted file mode 100644 index 7b15cb1c94..0000000000 --- a/.changeset/expose-series-limit-external-api.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -fix: Expose `seriesLimit` via external API and MCP \ No newline at end of file diff --git a/.changeset/fair-headers-buffer.md b/.changeset/fair-headers-buffer.md deleted file mode 100644 index dca0961906..0000000000 --- a/.changeset/fair-headers-buffer.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -Preserve query result rows when streamed ClickHouse headers span chunks. diff --git a/.changeset/fix-timepicker-zindex-over-chart-tooltip.md b/.changeset/fix-timepicker-zindex-over-chart-tooltip.md deleted file mode 100644 index e4f4155f2f..0000000000 --- a/.changeset/fix-timepicker-zindex-over-chart-tooltip.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Prevent chart hover tooltips from rendering over the date range picker diff --git a/.changeset/fuzzy-escaped-quotes.md b/.changeset/fuzzy-escaped-quotes.md deleted file mode 100644 index 7b1d513fef..0000000000 --- a/.changeset/fuzzy-escaped-quotes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/common-utils': patch ---- - -Correctly split SQL expressions containing backslash-escaped quotes. diff --git a/.changeset/heatmap-tooltip-percentile.md b/.changeset/heatmap-tooltip-percentile.md deleted file mode 100644 index 03354d4b9f..0000000000 --- a/.changeset/heatmap-tooltip-percentile.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -Show percentile context in the heatmap hover tooltip diff --git a/.changeset/hide-histogram-agg-fns.md b/.changeset/hide-histogram-agg-fns.md deleted file mode 100644 index d64561cdd2..0000000000 --- a/.changeset/hide-histogram-agg-fns.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Hide unsupported aggregation functions for Histogram metrics in the chart builder diff --git a/.changeset/lucene-encode-all-url-tokens.md b/.changeset/lucene-encode-all-url-tokens.md deleted file mode 100644 index 3da4b65a53..0000000000 --- a/.changeset/lucene-encode-all-url-tokens.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@hyperdx/common-utils': patch ---- - -fix: Encode every `http://`, `https://` and `localhost:` in a search, not -just the first - -A search naming two or more URLs left the later colons unescaped, so Lucene read -them as field queries. `http://a.com http://b.com` compiled the second URL to -`http ILIKE '%//b.com%'` — a predicate on a bare `http` identifier rather than a -search of the log body. diff --git a/.changeset/mantine-theme-refinements.md b/.changeset/mantine-theme-refinements.md deleted file mode 100644 index a580f66857..0000000000 --- a/.changeset/mantine-theme-refinements.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -Refine Mantine theme styling: a true 1px tab list line with matching 1px -non-active tab hover borders, code blocks (Mantine `Code`) use the -`--color-bg-code` token, and the SegmentedControl active indicator gets a border, -small radius, and a dedicated `--color-bg-option-active` background. Primary -HyperDX buttons are now more prominent, using the solid brand green background -instead of the subtle tinted fill. diff --git a/.changeset/metric-table-autofill-on-database-change.md b/.changeset/metric-table-autofill-on-database-change.md deleted file mode 100644 index cd349fc59c..0000000000 --- a/.changeset/metric-table-autofill-on-database-change.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Only auto-detect metric tables when the database selection changes diff --git a/.changeset/metrics-v15-series-table.md b/.changeset/metrics-v15-series-table.md deleted file mode 100644 index 068490952d..0000000000 --- a/.changeset/metrics-v15-series-table.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@hyperdx/app': minor -'@hyperdx/api': minor -'@hyperdx/common-utils': minor ---- - -feat: Allow configuring a `series` table for accelerating metrics diff --git a/.changeset/prominent-view-trace-action.md b/.changeset/prominent-view-trace-action.md deleted file mode 100644 index a0369d63de..0000000000 --- a/.changeset/prominent-view-trace-action.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -Make the log side panel "View Trace" action more noticeable: it now uses an -outlined (secondary) button with the trace source icon, larger compact size, and -is right-aligned so it stands out from the dimmed metadata row instead of -blending in as subtle inline text. The first time a log with a correlated trace -is opened, a one-time popover points users to the button; it is dismissed by an -explicit acknowledgement ("Got it" or clicking View Trace) and then never shows -again (persisted per browser). It deliberately does not intercept Escape, which -keeps its normal side-panel behavior. diff --git a/.changeset/query-exemplars-route.md b/.changeset/query-exemplars-route.md deleted file mode 100644 index e4a43c2d83..0000000000 --- a/.changeset/query-exemplars-route.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -'@hyperdx/api': minor ---- - -feat: add /v1/prometheus/query_exemplars, and harden the Prometheus proxy - -Adds a `query_exemplars` route that proxies to Prometheus's native -`/api/v1/query_exemplars` for Prometheus-backed connections, and answers with an -empty success for ClickHouse-backed ones, where exemplars are read from the metric -table instead. - -Three fixes to the shared proxy while adding a route to it: - -- Responses now carry `X-Content-Type-Options: nosniff`, set before anything can - return so the proxy's own error bodies get it too, and the upstream content-type - is never forwarded — every response is relabelled `application/json`. The - connection host is member-configured, so its response body is untrusted output on - our own origin, and an allowlist is easy to slip past: `application/json, - text/html` clears a prefix-anchored JSON test while the browser keeps the last - media type. -- A client that navigates away mid-body no longer counts as a backend error. -- Proxy failures increment `prometheusQueryErrors`. `proxyToPrometheus` handles its - own failures and returns normally, so the callers' `catch` never ran and all four - proxied endpoints reported zero errors while still recording duration. Counted on - 5xx only, so a user's malformed PromQL does not read as a backend fault. -- The exemplar window is bounded by narrowing rather than rejecting, so a wide - dashboard range still works. diff --git a/.changeset/range-open-exclusive-bounds.md b/.changeset/range-open-exclusive-bounds.md deleted file mode 100644 index dac633503a..0000000000 --- a/.changeset/range-open-exclusive-bounds.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/common-utils': patch ---- - -Honor open (`*`), exclusive (`{}`) and non-numeric bounds in Lucene ranges - -`Duration:[* TO 500]` compiled to `Duration BETWEEN '*' AND 500`, which -ClickHouse rejects with `TYPE_MISMATCH`. Exclusive and half-open ranges such as -`Duration:{100 TO 500}` were all serialized as an inclusive `BETWEEN`. Bounds -were parsed with `parseFloat`, so `Timestamp:[2024-01-01 TO 2024-06-01]` became -`BETWEEN 2024 AND 2024` and matched nothing. The plain-English explanation of a -search now marks excluded bounds too. diff --git a/.changeset/rate-limit-per-access-key.md b/.changeset/rate-limit-per-access-key.md deleted file mode 100644 index 04ed2fa732..0000000000 --- a/.changeset/rate-limit-per-access-key.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -Key the external API and MCP rate limiters on the access key, not the raw -`Authorization` header - -`validateUserAccessKey` accepts any text before `Bearer `, so a single access -key authenticates under unlimited header spellings. The limiter bucketed on the -header value, so varying that prefix handed each request a fresh quota. Requests -that carry no usable access key now fall back to the client IP. diff --git a/.changeset/remember-side-panel-tab.md b/.changeset/remember-side-panel-tab.md deleted file mode 100644 index c0f996be25..0000000000 --- a/.changeset/remember-side-panel-tab.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -Remember the row side panel's last-used tab instead of resetting to Overview on -every open, so working through a list of rows in Column Values no longer means -re-clicking that tab on each one. Picking a neighbouring row out of Surrounding -Context also keeps you in your chosen view rather than dropping you back on -Overview. Navigations that target a specific tab (such as View Trace) still win, -and a remembered tab the row doesn't offer falls back to that row's default. diff --git a/.changeset/root-changelog-whats-new.md b/.changeset/root-changelog-whats-new.md deleted file mode 100644 index eb5df8b216..0000000000 --- a/.changeset/root-changelog-whats-new.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': minor ---- - -feat: the in-app "What's new" changelog now shows the cross-package release -summary from the root CHANGELOG.md instead of the app-only package changelog diff --git a/.changeset/select-star-error-state.md b/.changeset/select-star-error-state.md deleted file mode 100644 index 31ac96adf1..0000000000 --- a/.changeset/select-star-error-state.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Improve the Distributed table `SELECT *` error state \ No newline at end of file diff --git a/.changeset/series-limit-groupby-and-compare-fixes.md b/.changeset/series-limit-groupby-and-compare-fixes.md deleted file mode 100644 index 2c5c8b3acb..0000000000 --- a/.changeset/series-limit-groupby-and-compare-fixes.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/common-utils': patch -'@hyperdx/app': patch ---- - -fix: Use ratio value for series-limit ranking in ratio mode - -Charts using "ratio" series return type together with a series limit ranked the -top-N series by the bare numerator instead of by the plotted ratio, so a -low-volume group with a high ratio could lose its slot to a high-volume group -with a much lower ratio. The ranking now uses the same `divide(a, b)` expression -the chart displays. Non-ratio charts generate identical SQL to before. diff --git a/.changeset/shorten-all-relative-time-units.md b/.changeset/shorten-all-relative-time-units.md deleted file mode 100644 index 3a63b15855..0000000000 --- a/.changeset/shorten-all-relative-time-units.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Abbreviate every unit in relative timestamps - -Plural months rendered as `3mo.s ago`, and `1 second`, `1 year` and `2 years` -were not abbreviated at all, so session lists and the row side panel mixed -`5m ago` with `2 years ago`. diff --git a/.changeset/span-attributes-key-column-overlap.md b/.changeset/span-attributes-key-column-overlap.md deleted file mode 100644 index 41b84dff33..0000000000 --- a/.changeset/span-attributes-key-column-overlap.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/app': patch ---- - -fix: Prevent long attribute values from painting over the key column in the JSON attributes viewer diff --git a/.changeset/team-invitation-scoping.md b/.changeset/team-invitation-scoping.md deleted file mode 100644 index 29cd86eafd..0000000000 --- a/.changeset/team-invitation-scoping.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@hyperdx/api': patch ---- - -Scope `DELETE /team/invitation/:id` to the caller's team. It previously deleted by id alone, so any authenticated user could revoke another team's pending invitation if they knew its id. Unknown or out-of-team ids now return 404. diff --git a/.changeset/terraform-iac-helpers.md b/.changeset/terraform-iac-helpers.md deleted file mode 100644 index 1561efe76e..0000000000 --- a/.changeset/terraform-iac-helpers.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@hyperdx/common-utils': minor -'@hyperdx/app': minor -'@hyperdx/api': minor ---- - -Add Terraform helpers for adopting existing HyperDX resources with the ClickHouse provider. An "Export to Terraform" button on dashboards, saved searches, and saved-search alerts shows a ready-to-paste `import {}` block plus collapsible provider setup, and a team settings section ("API & Agents") downloads an import file covering dashboards, alerts, saved searches, sources, connections, and webhooks. - -Dashboards carrying a tile the provider cannot represent, and PromQL sources, are excluded from the export and reported as skipped — in the UI and in the generated file. The provider reads a dashboard back through the external API v2, which either drops such a tile or substitutes an empty line chart, and writes tiles back whole, so importing one would destroy that tile on the next apply. - -Import-only by design: resource configuration is generated by `terraform plan -generate-config-out`, which reads through the provider, rather than by HyperDX — the external API's dashboard serialisation is a field allowlist, so generating `dashboard_json` from it could silently drop tile settings on apply. Tile alerts are excluded because the provider models only saved-search alerts. - -Terraform addresses are derived from each resource's id, not its name, so renaming a resource in HyperDX and re-exporting does not produce a destroy-and-recreate plan. The generator lives in `@hyperdx/common-utils` so the API can produce the same artefact the UI does. The manifest endpoint caps each listing at 1000 rows and reports which types were capped, so a very large team is told its export is partial rather than silently receiving one. - -Also redacts `Authorization` and `Cookie` headers from API request logs. diff --git a/.changeset/timestamp-type-detection-spellings.md b/.changeset/timestamp-type-detection-spellings.md deleted file mode 100644 index 1d2f3bc8d2..0000000000 --- a/.changeset/timestamp-type-detection-spellings.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@hyperdx/common-utils': patch ---- - -Detect ClickHouse timestamp types that carry a timezone or a type wrapper - -`DateTime('UTC')` was not classified as a DateTime, so a source whose timestamp -column listed both a `Date` partition column and a `DateTime` column bucketed -charts on the `Date` — collapsing a whole day into one bar at midnight. The time -filter also only wrapped bounds in `toDate()` for an exact `Date` type, so a -`Date32` or `Nullable(Date)` column was compared against a DateTime bound and -lost the whole start day. diff --git a/.changeset/view-trace-row-lookup-time-filter.md b/.changeset/view-trace-row-lookup-time-filter.md deleted file mode 100644 index d3833091f8..0000000000 --- a/.changeset/view-trace-row-lookup-time-filter.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@hyperdx/app': patch -'@hyperdx/common-utils': patch ---- - -fix: Bound the side panel's row lookup after "View Trace" to a time window diff --git a/.env b/.env index 5358d560d9..c9fe4e8b95 100644 --- a/.env +++ b/.env @@ -8,8 +8,8 @@ NEXT_ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-all-in-one ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-all-in-one NEXT_OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-otel-collector OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-otel-collector -CODE_VERSION=2.33.0 -IMAGE_VERSION_SUB_TAG=.33.0 +CODE_VERSION=2.34.0 +IMAGE_VERSION_SUB_TAG=.34.0 IMAGE_VERSION=2 IMAGE_NIGHTLY_TAG=2-nightly IMAGE_LATEST_TAG=latest diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md index f919f0d4f5..408d23c49d 100644 --- a/packages/api/CHANGELOG.md +++ b/packages/api/CHANGELOG.md @@ -1,5 +1,81 @@ # @hyperdx/api +## 2.34.0 + +### Minor Changes + +- 3d61cf92: Cap high-cardinality time-chart series to protect the browser from rendering + thousands of lines at once. Time charts now materialize and draw a bounded + number of series per tile, with escape hatches to reveal the rest on demand: a + "+N more" affordance in the hover and pinned tooltips, and a "load all series" + action that lifts the cap for a chart. Tooltips also cap how many rows they + render per frame so a wide bucket can't mount thousands of popovers. The + external dashboards API exposes the per-tile series limit as a three-state value + across tile types — omit for the default cap, 0 for unlimited, or a positive N + for the top N +- fa73b84c: feat(mcp): add `clickstack_emerging_signals` MCP tool — a two-window Drain pattern novelty detector that set-differences mined log/event patterns between an earlier baseline window and a current window to surface what is newly emerging or has disappeared. Shares the Drain sample-and-mine pipeline with `clickstack_event_patterns` via an extracted `mineWindowPatterns` helper, and keys patterns across windows with a `normalizeTemplate` helper. +- 97ca34df: feat: Allow configuring a `series` table for accelerating metrics +- f9c52445: feat: add /v1/prometheus/query_exemplars, and harden the Prometheus proxy + + Adds a `query_exemplars` route that proxies to Prometheus's native + `/api/v1/query_exemplars` for Prometheus-backed connections, and answers with an + empty success for ClickHouse-backed ones, where exemplars are read from the metric + table instead. + + Three fixes to the shared proxy while adding a route to it: + + - Responses now carry `X-Content-Type-Options: nosniff`, set before anything can + return so the proxy's own error bodies get it too, and the upstream content-type + is never forwarded — every response is relabelled `application/json`. The + connection host is member-configured, so its response body is untrusted output on + our own origin, and an allowlist is easy to slip past: `application/json, +text/html` clears a prefix-anchored JSON test while the browser keeps the last + media type. + - A client that navigates away mid-body no longer counts as a backend error. + - Proxy failures increment `prometheusQueryErrors`. `proxyToPrometheus` handles its + own failures and returns normally, so the callers' `catch` never ran and all four + proxied endpoints reported zero errors while still recording duration. Counted on + 5xx only, so a user's malformed PromQL does not read as a backend fault. + - The exemplar window is bounded by narrowing rather than rejecting, so a wide + dashboard range still works. + +- 1af1998c: Add Terraform helpers for adopting existing HyperDX resources with the ClickHouse provider. An "Export to Terraform" button on dashboards, saved searches, and saved-search alerts shows a ready-to-paste `import {}` block plus collapsible provider setup, and a team settings section ("API & Agents") downloads an import file covering dashboards, alerts, saved searches, sources, connections, and webhooks. + + Dashboards carrying a tile the provider cannot represent, and PromQL sources, are excluded from the export and reported as skipped — in the UI and in the generated file. The provider reads a dashboard back through the external API v2, which either drops such a tile or substitutes an empty line chart, and writes tiles back whole, so importing one would destroy that tile on the next apply. + + Import-only by design: resource configuration is generated by `terraform plan -generate-config-out`, which reads through the provider, rather than by HyperDX — the external API's dashboard serialisation is a field allowlist, so generating `dashboard_json` from it could silently drop tile settings on apply. Tile alerts are excluded because the provider models only saved-search alerts. + + Terraform addresses are derived from each resource's id, not its name, so renaming a resource in HyperDX and re-exporting does not produce a destroy-and-recreate plan. The generator lives in `@hyperdx/common-utils` so the API can produce the same artefact the UI does. The manifest endpoint caps each listing at 1000 rows and reports which types were capped, so a very large team is told its export is partial rather than silently receiving one. + + Also redacts `Authorization` and `Cookie` headers from API request logs. + +### Patch Changes + +- 3f87fe4b: Return 404 when updating a missing alert. +- 94d028c8: Return a not-found response when updating a missing dashboard. +- a794562d: Clear stale source-specific alert references when changing alert source. +- 2d78083a: fix: Expose `seriesLimit` via external API and MCP +- 1c3be6f0: Key the external API and MCP rate limiters on the access key, not the raw + `Authorization` header + + `validateUserAccessKey` accepts any text before `Bearer `, so a single access + key authenticates under unlimited header spellings. The limiter bucketed on the + header value, so varying that prefix handed each request a fresh quota. Requests + that carry no usable access key now fall back to the client IP. + +- 1af1998c: Scope `DELETE /team/invitation/:id` to the caller's team. It previously deleted by id alone, so any authenticated user could revoke another team's pending invitation if they knew its id. Unknown or out-of-team ids now return 404. +- Updated dependencies [3d61cf92] +- Updated dependencies [ed9d9a67] +- Updated dependencies [c97789a0] +- Updated dependencies [2468b256] +- Updated dependencies [97ca34df] +- Updated dependencies [6a35df06] +- Updated dependencies [d1c669dc] +- Updated dependencies [1af1998c] +- Updated dependencies [b082f700] +- Updated dependencies [347f0a69] + - @hyperdx/common-utils@0.25.0 + ## 2.33.0 ### Minor Changes diff --git a/packages/api/package.json b/packages/api/package.json index 3a05a3d60e..7832cf2243 100644 --- a/packages/api/package.json +++ b/packages/api/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/api", - "version": "2.33.0", + "version": "2.34.0", "license": "MIT", "private": true, "engines": { @@ -12,7 +12,7 @@ "@braintree/sanitize-url": "^7.1.1", "@clickhouse/client-common": "1.23.0-head.fae5998.1", "@esm2cjs/p-queue": "^7.3.0", - "@hyperdx/common-utils": "^0.24.1", + "@hyperdx/common-utils": "^0.25.0", "@hyperdx/node-opentelemetry": "^0.9.0", "@hyperdx/passport-local-mongoose": "^9.0.1", "@modelcontextprotocol/sdk": "^1.27.1", diff --git a/packages/app/CHANGELOG.md b/packages/app/CHANGELOG.md index 9297a4fbc7..c5177b5f01 100644 --- a/packages/app/CHANGELOG.md +++ b/packages/app/CHANGELOG.md @@ -1,5 +1,102 @@ # @hyperdx/app +## 2.34.0 + +### Minor Changes + +- 3d61cf92: Cap high-cardinality time-chart series to protect the browser from rendering + thousands of lines at once. Time charts now materialize and draw a bounded + number of series per tile, with escape hatches to reveal the rest on demand: a + "+N more" affordance in the hover and pinned tooltips, and a "load all series" + action that lifts the cap for a chart. Tooltips also cap how many rows they + render per frame so a wide bucket can't mount thousands of popovers. The + external dashboards API exposes the per-tile series limit as a three-state value + across tile types — omit for the default cap, 0 for unlimited, or a positive N + for the top N +- 97ca34df: feat: Allow configuring a `series` table for accelerating metrics +- 329a6260: feat: the in-app "What's new" changelog now shows the cross-package release + summary from the root CHANGELOG.md instead of the app-only package changelog +- 1af1998c: Add Terraform helpers for adopting existing HyperDX resources with the ClickHouse provider. An "Export to Terraform" button on dashboards, saved searches, and saved-search alerts shows a ready-to-paste `import {}` block plus collapsible provider setup, and a team settings section ("API & Agents") downloads an import file covering dashboards, alerts, saved searches, sources, connections, and webhooks. + + Dashboards carrying a tile the provider cannot represent, and PromQL sources, are excluded from the export and reported as skipped — in the UI and in the generated file. The provider reads a dashboard back through the external API v2, which either drops such a tile or substitutes an empty line chart, and writes tiles back whole, so importing one would destroy that tile on the next apply. + + Import-only by design: resource configuration is generated by `terraform plan -generate-config-out`, which reads through the provider, rather than by HyperDX — the external API's dashboard serialisation is a field allowlist, so generating `dashboard_json` from it could silently drop tile settings on apply. Tile alerts are excluded because the provider models only saved-search alerts. + + Terraform addresses are derived from each resource's id, not its name, so renaming a resource in HyperDX and re-exporting does not produce a destroy-and-recreate plan. The generator lives in `@hyperdx/common-utils` so the API can produce the same artefact the UI does. The manifest endpoint caps each listing at 1000 rows and reports which types were capped, so a very large team is told its export is partial rather than silently receiving one. + + Also redacts `Authorization` and `Cookie` headers from API request logs. + +### Patch Changes + +- 8f1f4e1d: - Added a "Show All Series" button to clear a focused chart series + - Fixed chart tooltip action buttons rendering behind the tooltip + - Added a max height and scroll to the legend "+N more" list +- a379d502: fix: SQL error when clicking "Search" on a log attached to a trace while in the Traces view +- ce23da27: feat(dashboards): add a Replay search action to log and trace dashboard tiles whose event query can be faithfully reconstructed. The action opens a new Search tab with the tile's source, query, filters, and dashboard time range preserved. +- 78b4a250: fix: Prevent the search page from defaulting to an incompatible source kind +- d059cb20: Preserve query result rows when streamed ClickHouse headers span chunks. +- 1b76584c: fix: Prevent chart hover tooltips from rendering over the date range picker +- 17408ef1: Show percentile context in the heatmap hover tooltip +- cf9314be: fix: Hide unsupported aggregation functions for Histogram metrics in the chart builder +- a42db648: Refine Mantine theme styling: a true 1px tab list line with matching 1px + non-active tab hover borders, code blocks (Mantine `Code`) use the + `--color-bg-code` token, and the SegmentedControl active indicator gets a border, + small radius, and a dedicated `--color-bg-option-active` background. Primary + HyperDX buttons are now more prominent, using the solid brand green background + instead of the subtle tinted fill. +- 9ab1d901: fix: Only auto-detect metric tables when the database selection changes +- de527bfa: Make the log side panel "View Trace" action more noticeable: it now uses an + outlined (secondary) button with the trace source icon, larger compact size, and + is right-aligned so it stands out from the dimmed metadata row instead of + blending in as subtle inline text. The first time a log with a correlated trace + is opened, a one-time popover points users to the button; it is dismissed by an + explicit acknowledgement ("Got it" or clicking View Trace) and then never shows + again (persisted per browser). It deliberately does not intercept Escape, which + keeps its normal side-panel behavior. +- a15bf4f0: Remember the row side panel's last-used tab instead of resetting to Overview on + every open, so working through a list of rows in Column Values no longer means + re-clicking that tab on each one. Picking a neighbouring row out of Surrounding + Context also keeps you in your chosen view rather than dropping you back on + Overview. Navigations that target a specific tab (such as View Trace) still win, + and a remembered tab the row doesn't offer falls back to that row's default. +- 5da600a8: fix: Improve the Distributed table `SELECT *` error state +- d1c669dc: fix: Use ratio value for series-limit ranking in ratio mode + + Charts using "ratio" series return type together with a series limit ranked the + top-N series by the bare numerator instead of by the plotted ratio, so a + low-volume group with a high ratio could lose its slot to a high-volume group + with a much lower ratio. The ranking now uses the same `divide(a, b)` expression + the chart displays. Non-ratio charts generate identical SQL to before. + +- 698cdc35: fix: Abbreviate every unit in relative timestamps + + Plural months rendered as `3mo.s ago`, and `1 second`, `1 year` and `2 years` + were not abbreviated at all, so session lists and the row side panel mixed + `5m ago` with `2 years ago`. + +- 16bdb404: fix: Prevent long attribute values from painting over the key column in the JSON attributes viewer +- 347f0a69: fix: Bound the side panel's row lookup after "View Trace" to a time window +- Updated dependencies [3f87fe4b] +- Updated dependencies [94d028c8] +- Updated dependencies [a794562d] +- Updated dependencies [3d61cf92] +- Updated dependencies [fa73b84c] +- Updated dependencies [ed9d9a67] +- Updated dependencies [2d78083a] +- Updated dependencies [c97789a0] +- Updated dependencies [2468b256] +- Updated dependencies [97ca34df] +- Updated dependencies [f9c52445] +- Updated dependencies [6a35df06] +- Updated dependencies [1c3be6f0] +- Updated dependencies [d1c669dc] +- Updated dependencies [1af1998c] +- Updated dependencies [1af1998c] +- Updated dependencies [b082f700] +- Updated dependencies [347f0a69] + - @hyperdx/api@2.34.0 + - @hyperdx/common-utils@0.25.0 + ## 2.33.0 ### Minor Changes diff --git a/packages/app/package.json b/packages/app/package.json index 3def64f2da..0096acd488 100644 --- a/packages/app/package.json +++ b/packages/app/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/app", - "version": "2.33.0", + "version": "2.34.0", "private": true, "license": "MIT", "engines": { @@ -38,7 +38,7 @@ "@hookform/resolvers": "^3.9.0", "@hyperdx/api": "workspace:*", "@hyperdx/browser": "^0.22.1", - "@hyperdx/common-utils": "^0.24.1", + "@hyperdx/common-utils": "^0.25.0", "@hyperdx/node-opentelemetry": "^0.9.0", "@mantine/core": "^9.0.0", "@mantine/dates": "^9.0.0", diff --git a/packages/cli/package.json b/packages/cli/package.json index 94a6ff9b68..ece69f2dac 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -41,7 +41,7 @@ }, "devDependencies": { "@clickhouse/client": "1.23.0-head.fae5998.1", - "@hyperdx/common-utils": "^0.24.0", + "@hyperdx/common-utils": "^0.25.0", "@jest/globals": "^30.2.0", "@types/crypto-js": "^4.2.2", "@types/jest": "^29.5.14", diff --git a/packages/common-utils/CHANGELOG.md b/packages/common-utils/CHANGELOG.md index f9b75fc8c0..cd8b537c69 100644 --- a/packages/common-utils/CHANGELOG.md +++ b/packages/common-utils/CHANGELOG.md @@ -1,5 +1,75 @@ # @hyperdx/common-utils +## 0.25.0 + +### Minor Changes + +- 3d61cf92: Cap high-cardinality time-chart series to protect the browser from rendering + thousands of lines at once. Time charts now materialize and draw a bounded + number of series per tile, with escape hatches to reveal the rest on demand: a + "+N more" affordance in the hover and pinned tooltips, and a "load all series" + action that lifts the cap for a chart. Tooltips also cap how many rows they + render per frame so a wide bucket can't mount thousands of popovers. The + external dashboards API exposes the per-tile series limit as a three-state value + across tile types — omit for the default cap, 0 for unlimited, or a positive N + for the top N +- 97ca34df: feat: Allow configuring a `series` table for accelerating metrics +- 1af1998c: Add Terraform helpers for adopting existing HyperDX resources with the ClickHouse provider. An "Export to Terraform" button on dashboards, saved searches, and saved-search alerts shows a ready-to-paste `import {}` block plus collapsible provider setup, and a team settings section ("API & Agents") downloads an import file covering dashboards, alerts, saved searches, sources, connections, and webhooks. + + Dashboards carrying a tile the provider cannot represent, and PromQL sources, are excluded from the export and reported as skipped — in the UI and in the generated file. The provider reads a dashboard back through the external API v2, which either drops such a tile or substitutes an empty line chart, and writes tiles back whole, so importing one would destroy that tile on the next apply. + + Import-only by design: resource configuration is generated by `terraform plan -generate-config-out`, which reads through the provider, rather than by HyperDX — the external API's dashboard serialisation is a field allowlist, so generating `dashboard_json` from it could silently drop tile settings on apply. Tile alerts are excluded because the provider models only saved-search alerts. + + Terraform addresses are derived from each resource's id, not its name, so renaming a resource in HyperDX and re-exporting does not produce a destroy-and-recreate plan. The generator lives in `@hyperdx/common-utils` so the API can produce the same artefact the UI does. The manifest endpoint caps each listing at 1000 rows and reports which types were capped, so a very large team is told its export is partial rather than silently receiving one. + + Also redacts `Authorization` and `Cookie` headers from API request logs. + +### Patch Changes + +- ed9d9a67: Treat `_` and `%` in a search term as literal characters, not LIKE wildcards + + Search terms were interpolated straight into the ILIKE pattern, so ClickHouse + read their `_` and `%` as wildcards. `ServiceName:user_service` also matched + `user-service` and `user.service`, and the negated `-ServiceName:user_service` + dropped those same rows. Token-index lookups still receive the raw term. + +- c97789a0: Correctly split SQL expressions containing backslash-escaped quotes. +- 2468b256: fix: Encode every `http://`, `https://` and `localhost:` in a search, not + just the first + + A search naming two or more URLs left the later colons unescaped, so Lucene read + them as field queries. `http://a.com http://b.com` compiled the second URL to + `http ILIKE '%//b.com%'` — a predicate on a bare `http` identifier rather than a + search of the log body. + +- 6a35df06: Honor open (`*`), exclusive (`{}`) and non-numeric bounds in Lucene ranges + + `Duration:[* TO 500]` compiled to `Duration BETWEEN '*' AND 500`, which + ClickHouse rejects with `TYPE_MISMATCH`. Exclusive and half-open ranges such as + `Duration:{100 TO 500}` were all serialized as an inclusive `BETWEEN`. Bounds + were parsed with `parseFloat`, so `Timestamp:[2024-01-01 TO 2024-06-01]` became + `BETWEEN 2024 AND 2024` and matched nothing. The plain-English explanation of a + search now marks excluded bounds too. + +- d1c669dc: fix: Use ratio value for series-limit ranking in ratio mode + + Charts using "ratio" series return type together with a series limit ranked the + top-N series by the bare numerator instead of by the plotted ratio, so a + low-volume group with a high ratio could lose its slot to a high-volume group + with a much lower ratio. The ranking now uses the same `divide(a, b)` expression + the chart displays. Non-ratio charts generate identical SQL to before. + +- b082f700: Detect ClickHouse timestamp types that carry a timezone or a type wrapper + + `DateTime('UTC')` was not classified as a DateTime, so a source whose timestamp + column listed both a `Date` partition column and a `DateTime` column bucketed + charts on the `Date` — collapsing a whole day into one bar at midnight. The time + filter also only wrapped bounds in `toDate()` for an exact `Date` type, so a + `Date32` or `Nullable(Date)` column was compared against a DateTime bound and + lost the whole start day. + +- 347f0a69: fix: Bound the side panel's row lookup after "View Trace" to a time window + ## 0.24.1 ### Patch Changes diff --git a/packages/common-utils/package.json b/packages/common-utils/package.json index 33d6439858..86469940b2 100644 --- a/packages/common-utils/package.json +++ b/packages/common-utils/package.json @@ -1,7 +1,7 @@ { "name": "@hyperdx/common-utils", "description": "Common utilities for HyperDX application", - "version": "0.24.1", + "version": "0.25.0", "license": "MIT", "private": true, "files": [ diff --git a/packages/hdx-eval/CHANGELOG.md b/packages/hdx-eval/CHANGELOG.md index 7941c0d8d2..b69cc677b0 100644 --- a/packages/hdx-eval/CHANGELOG.md +++ b/packages/hdx-eval/CHANGELOG.md @@ -1,5 +1,11 @@ # @hyperdx/hdx-eval +## 0.3.1 + +### Patch Changes + +- 1dfcbcb8: feat(evals): add deploy-regression scenario (metrics-neutral) — a checkout-api staged-rollout defect fully solvable from traces/logs, with corroborating-only metrics to measure organic metric-tool adoption + ## 0.3.0 ### Minor Changes diff --git a/packages/hdx-eval/package.json b/packages/hdx-eval/package.json index dd6e9480b3..aa846e385e 100644 --- a/packages/hdx-eval/package.json +++ b/packages/hdx-eval/package.json @@ -1,6 +1,6 @@ { "name": "@hyperdx/hdx-eval", - "version": "0.3.0", + "version": "0.3.1", "license": "MIT", "private": true, "engines": { diff --git a/packages/otel-collector/CHANGELOG.md b/packages/otel-collector/CHANGELOG.md index e47f0f4170..2622ed183d 100644 --- a/packages/otel-collector/CHANGELOG.md +++ b/packages/otel-collector/CHANGELOG.md @@ -1,5 +1,7 @@ # @hyperdx/otel-collector +## 2.34.0 + ## 2.33.0 ## 2.32.0 diff --git a/packages/otel-collector/package.json b/packages/otel-collector/package.json index 4019827016..e27a51ea62 100644 --- a/packages/otel-collector/package.json +++ b/packages/otel-collector/package.json @@ -1,7 +1,7 @@ { "name": "@hyperdx/otel-collector", "description": "HyperDX OpenTelemetry Collector configuration and Docker image", - "version": "2.33.0", + "version": "2.34.0", "license": "MIT", "private": true } diff --git a/yarn.lock b/yarn.lock index 261c1644da..06a68a7188 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4616,7 +4616,7 @@ __metadata: "@braintree/sanitize-url": "npm:^7.1.1" "@clickhouse/client-common": "npm:1.23.0-head.fae5998.1" "@esm2cjs/p-queue": "npm:^7.3.0" - "@hyperdx/common-utils": "npm:^0.24.1" + "@hyperdx/common-utils": "npm:^0.25.0" "@hyperdx/node-opentelemetry": "npm:^0.9.0" "@hyperdx/passport-local-mongoose": "npm:^9.0.1" "@modelcontextprotocol/sdk": "npm:^1.27.1" @@ -4708,7 +4708,7 @@ __metadata: "@hookform/resolvers": "npm:^3.9.0" "@hyperdx/api": "workspace:*" "@hyperdx/browser": "npm:^0.22.1" - "@hyperdx/common-utils": "npm:^0.24.1" + "@hyperdx/common-utils": "npm:^0.25.0" "@hyperdx/node-opentelemetry": "npm:^0.9.0" "@mantine/core": "npm:^9.0.0" "@mantine/dates": "npm:^9.0.0" @@ -4834,7 +4834,7 @@ __metadata: resolution: "@hyperdx/cli@workspace:packages/cli" dependencies: "@clickhouse/client": "npm:1.23.0-head.fae5998.1" - "@hyperdx/common-utils": "npm:^0.24.0" + "@hyperdx/common-utils": "npm:^0.25.0" "@jest/globals": "npm:^30.2.0" "@types/crypto-js": "npm:^4.2.2" "@types/jest": "npm:^29.5.14" @@ -4861,7 +4861,7 @@ __metadata: languageName: unknown linkType: soft -"@hyperdx/common-utils@npm:^0.24.0, @hyperdx/common-utils@npm:^0.24.1, @hyperdx/common-utils@workspace:packages/common-utils": +"@hyperdx/common-utils@npm:^0.25.0, @hyperdx/common-utils@workspace:packages/common-utils": version: 0.0.0-use.local resolution: "@hyperdx/common-utils@workspace:packages/common-utils" dependencies: From c85d3d397eac52f5711878a6603c8a232ce94022 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 7 Aug 2026 21:46:56 +0000 Subject: [PATCH 2/2] chore(release): update root CHANGELOG.md --- CHANGELOG.md | 196 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 196 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 741cdeea39..84f590a76d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,202 @@ PR — keep the `hyperdx-release-notes` comment marker intact when editing so yo edits survive regeneration. Per-package detail lives in each `packages/*/CHANGELOG.md`. +## v2.34.0 — 2026-08-07 + + + +This release makes your HyperDX resources adoptable into infrastructure as code: +dashboards, saved searches and saved-search alerts gain an "Export to Terraform" +action, and Team Settings can download an import file covering the whole team. +Metrics sources can now point at a `series` table to accelerate metric queries, a +new `clickstack_emerging_signals` MCP tool tells an agent which log patterns are +newly emerging or have disappeared between two windows, and Prometheus-backed +connections gain an exemplar query endpoint. Search also got a round of +correctness fixes — `_` and `%` are literal characters again, every URL in a +query is escaped rather than just the first, and open or exclusive ranges no +longer fail outright. Time charts now cap high-cardinality tiles to a bounded +number of series with a load-all escape hatch — read the breaking change below +before upgrading a chart or an API client that relies on getting every series. + +### 💥 Breaking Changes + +- **Time charts cap high-cardinality series by default**: a tile grouped by a + high-cardinality field no longer tries to draw every line — time charts now + materialise and render a bounded number of series per tile, which keeps the + browser responsive but means a chart that previously drew thousands of series + now shows the top N. Escape hatches are built in: a "+N more" affordance in + the hover and pinned tooltips, and a "load all series" action that lifts the + cap for a chart. Tooltips also bound how many rows they render per frame, so a + wide bucket can't mount thousands of popovers. Over the external dashboards + API the per-tile series limit is a three-state value across tile types — omit + it for the default cap, `0` for unlimited, or a positive N for the top N — so + a client that relied on omitting the field to get every series should now send + `0` (#2802). + +### ✨ New Features + +- **Export existing resources to Terraform**: dashboards, saved searches and + saved-search alerts gain an "Export to Terraform" button showing a + ready-to-paste `import {}` block plus collapsible provider setup, and a new + "API & Agents" section in Team Settings downloads an import file covering + dashboards, alerts, saved searches, sources, connections and webhooks. The + export is import-only by design — resource configuration comes from + `terraform plan -generate-config-out` reading through the ClickHouse provider, + not from HyperDX. Dashboards carrying a tile the provider cannot represent, and + PromQL sources, are reported as skipped rather than exported, and each listing + caps at 1000 rows and tells you which types were capped so a large team knows + its export is partial. Terraform addresses derive from resource ids rather than + names, so renaming a resource and re-exporting won't produce a + destroy-and-recreate plan (#2741). +- **Configure a `series` table to accelerate metrics**: metrics sources can now + name a `series` table, giving metric queries a smaller table to resolve series + from (#2763). +- **`clickstack_emerging_signals` MCP tool**: an agent can now diff mined log and + event patterns between an earlier baseline window and the current one, surfacing + which patterns are newly emerging and which have disappeared — a direct answer + to "what changed?" during an incident (#2701). +- **Prometheus exemplar queries**: a new `/v1/prometheus/query_exemplars` + endpoint proxies to Prometheus's native `/api/v1/query_exemplars` for + Prometheus-backed connections, and answers with an empty success for + ClickHouse-backed ones, where exemplars are read from the metric table instead. + A wide dashboard range is narrowed to the supported exemplar window rather than + rejected (#2806). +- **Replay a dashboard tile's query in Search**: log and trace tiles whose event + query can be faithfully reconstructed gain a Replay search action, which opens + a new Search tab with the tile's source, query, filters and the dashboard's + time range preserved — so you can go from a spike on a dashboard to the events + behind it without rebuilding the query by hand (#2648). + +### 🔧 Improvements + +- **"What's new" shows the cross-package release summary**: the in-app changelog + now renders the release-level highlights from the root changelog instead of the + app-only package changelog, so you see the whole release rather than just the + frontend changes (#2737). +- **`seriesLimit` over the external API and MCP**: the top-N series cap on line + and stacked bar tiles is now readable and settable through External API v2 and + MCP, so a dashboard authored by an agent can carry the same series cap as one + built in the UI (#2772). +- **The row side panel remembers your tab**: opening the next row keeps you on + the tab you were working in — Column Values, say — instead of resetting to + Overview, including when you pick a neighbouring row out of Surrounding + Context. Navigations that target a specific tab (such as View Trace) still win, + and a remembered tab a row doesn't offer falls back to that row's default + (#2752). +- **"View Trace" is easier to spot in the log side panel**: the action is now a + right-aligned outlined button with the trace source icon instead of subtle + inline text in the dimmed metadata row. The first time you open a log that has + a correlated trace, a one-time popover points you at the button; acknowledging + it ("Got it") or clicking View Trace dismisses it for good on that browser + (#2815). +- **Chart tooltips and legends behave better**: a new "Show All Series" button + clears a focused series, tooltip action buttons no longer render behind the + tooltip, the legend's "+N more" list is capped in height and scrolls, and chart + hover tooltips no longer paint over the date range picker (#2822, #2803). +- **Percentile context in the heatmap tooltip**: hovering a heatmap cell now + shows where that bucket sits in the distribution (#2789). +- **Only supported aggregations offered for histogram metrics**: the chart + builder hides aggregation functions a Histogram metric can't use, so you no + longer pick one and get an error back (#2793). +- **Prometheus proxy responses hardened and failures counted**: every proxied + response is relabelled `application/json` and carries + `X-Content-Type-Options: nosniff` — set before anything can return, so the + proxy's own error bodies get it too — since a member-configured connection host + otherwise returns untrusted content on your origin. Proxy failures now + increment `prometheusQueryErrors`, counted on 5xx only so malformed PromQL + doesn't read as a backend fault, where all four proxied endpoints previously + reported zero errors; a client that navigates away mid-body no longer counts as + a backend error either (#2806). +- **Theme refinements**: primary HyperDX buttons use the solid brand green rather + than a subtle tinted fill, tab lists get a true 1px line with matching 1px + hover borders on inactive tabs, code blocks use the dedicated code background + token, and the segmented control's active indicator gains a border, small + radius and its own background (#2814). +- **Clearer `SELECT *` error state on distributed tables**: the error is easier + to act on and now also shows on expanded rows (#2771). + +### 🐛 Bug Fixes + +- **`_` and `%` in a search term are literal again**: search terms were + interpolated straight into the ILIKE pattern, so ClickHouse read them as + wildcards — `ServiceName:user_service` also matched `user-service` and + `user.service`, and the negated `-ServiceName:user_service` dropped those same + rows. Token-index lookups still receive the raw term (#2774). +- **Every URL in a search is escaped, not just the first**: a query naming two or + more URLs left the later colons unescaped, so Lucene read them as field + queries — `http://a.com http://b.com` compiled the second URL to + `http ILIKE '%//b.com%'`, a predicate on a bare `http` identifier rather than a + search of the log body (#2764). +- **Open, exclusive and non-numeric range bounds are honoured**: + `Duration:[* TO 500]` compiled to `Duration BETWEEN '*' AND 500`, which + ClickHouse rejects with `TYPE_MISMATCH`; exclusive and half-open ranges like + `Duration:{100 TO 500}` were all serialised as an inclusive `BETWEEN`; and + bounds parsed with `parseFloat` turned + `Timestamp:[2024-01-01 TO 2024-06-01]` into `BETWEEN 2024 AND 2024`, matching + nothing. The plain-English explanation of a search now marks excluded bounds + too (#2779). +- **Timestamp columns carrying a timezone or type wrapper are detected**: + `DateTime('UTC')` wasn't classified as a DateTime, so a source listing both a + `Date` partition column and a `DateTime` column bucketed charts on the `Date`, + collapsing a whole day into one bar at midnight. Time filters now also wrap + bounds in `toDate()` for `Date32` and `Nullable(Date)` columns, which + previously lost the entire start day (#2780). +- **Series limits rank by the plotted ratio**: a chart using the "ratio" series + return type with a series limit ranked its top-N by the bare numerator, so a + low-volume group with a high ratio could lose its slot to a high-volume group + with a much lower one. Ranking now uses the same division the chart displays; + non-ratio charts generate identical SQL to before (#2759). +- **Query results no longer lose rows**: when ClickHouse's streamed response + headers spanned two chunks, the result rows that followed were dropped + (#2766). +- **SQL expressions containing escaped quotes split correctly**: a + backslash-escaped quote no longer causes an expression to be split in the wrong + place (#2767). +- **Rate limits are keyed on the access key**: the external API and MCP limiters + bucketed on the raw `Authorization` header value, and because any text is + accepted before `Bearer `, varying that prefix handed each request a fresh + quota. Limits now key on the access key itself, falling back to the client IP + when a request carries no usable key (#2781). +- **Invitation revocation is scoped to your team**: + `DELETE /team/invitation/:id` deleted by id alone, so any authenticated user + who knew an id could revoke another team's pending invitation. Unknown or + out-of-team ids now return 404. `Authorization` and `Cookie` headers are also + redacted from API request logs (#2741). +- **Updating a missing alert or dashboard returns not-found**: updates against an + id that doesn't exist now answer 404 rather than appearing to succeed, so an + API client can tell a real write from a no-op (#2784, #2768). +- **Changing an alert's source clears stale references**: source-specific fields + left behind by the previous source are cleared instead of pointing at + something the new source doesn't have (#2783). +- **Searching a log attached to a trace works from the Traces view**: clicking + "Search" on a log while viewing its trace raised a SQL error instead of running + the search against the log's own source (#2825). +- **"View Trace" row lookups are bounded to a time window**: the side panel's + lookup for the row behind a trace is now scoped to a time range instead of + being left open-ended, so it resolves without scanning a large source end to + end (#2816). +- **Search no longer defaults to an incompatible source**: the search page won't + pre-select a source whose kind it can't search (#2769). +- **Metric tables are only auto-detected when the database changes**: table + auto-detection no longer re-runs on unrelated edits to a metrics source, so the + tables you picked stay picked (#2817). +- **Assorted polish**: relative timestamps abbreviate every unit, so lists no + longer mix `5m ago` with `2 years ago` or render `3mo.s ago` (#2773), and long + values in the JSON attributes viewer no longer paint over the key column + (#2813). + + + +### 📦 Package changelogs + +- `@hyperdx/api` 2.33.0 → 2.34.0 — [changelog](https://github.com/hyperdxio/hyperdx/blob/main/packages/api/CHANGELOG.md#2340) +- `@hyperdx/app` 2.33.0 → 2.34.0 — [changelog](https://github.com/hyperdxio/hyperdx/blob/main/packages/app/CHANGELOG.md#2340) +- `@hyperdx/common-utils` 0.24.1 → 0.25.0 — [changelog](https://github.com/hyperdxio/hyperdx/blob/main/packages/common-utils/CHANGELOG.md#0250) +- `@hyperdx/hdx-eval` 0.3.0 → 0.3.1 — [changelog](https://github.com/hyperdxio/hyperdx/blob/main/packages/hdx-eval/CHANGELOG.md#031) +- `@hyperdx/otel-collector` 2.33.0 → 2.34.0 — [changelog](https://github.com/hyperdxio/hyperdx/blob/main/packages/otel-collector/CHANGELOG.md#2340) + + + ## v2.32.0 — 2026-07-27