hyperdxio · github-actions · Aug 6, 2026
diff --git a/.changeset/alert-update-not-found.md b/.changeset/alert-update-not-found.md
diff --git a/.changeset/bright-dashboard-not-found.md b/.changeset/bright-dashboard-not-found.md
diff --git a/.changeset/clear-stale-alert-source-fields.md b/.changeset/clear-stale-alert-source-fields.md
diff --git a/.changeset/default-search-source-compatible.md b/.changeset/default-search-source-compatible.md
diff --git a/.changeset/emerging-signals-mcp-tool.md b/.changeset/emerging-signals-mcp-tool.md
diff --git a/.changeset/escape-like-metacharacters-in-search.md b/.changeset/escape-like-metacharacters-in-search.md
diff --git a/.changeset/expose-series-limit-external-api.md b/.changeset/expose-series-limit-external-api.md
diff --git a/.changeset/fair-headers-buffer.md b/.changeset/fair-headers-buffer.md
diff --git a/.changeset/fix-timepicker-zindex-over-chart-tooltip.md b/.changeset/fix-timepicker-zindex-over-chart-tooltip.md
diff --git a/.changeset/fuzzy-escaped-quotes.md b/.changeset/fuzzy-escaped-quotes.md
diff --git a/.changeset/heatmap-tooltip-percentile.md b/.changeset/heatmap-tooltip-percentile.md
diff --git a/.changeset/hide-histogram-agg-fns.md b/.changeset/hide-histogram-agg-fns.md
diff --git a/.changeset/lucene-encode-all-url-tokens.md b/.changeset/lucene-encode-all-url-tokens.md
diff --git a/.changeset/mantine-theme-refinements.md b/.changeset/mantine-theme-refinements.md
diff --git a/.changeset/metric-table-autofill-on-database-change.md b/.changeset/metric-table-autofill-on-database-change.md
diff --git a/.changeset/metrics-v15-series-table.md b/.changeset/metrics-v15-series-table.md
diff --git a/.changeset/query-exemplars-route.md b/.changeset/query-exemplars-route.md
diff --git a/.changeset/range-open-exclusive-bounds.md b/.changeset/range-open-exclusive-bounds.md
diff --git a/.changeset/rate-limit-per-access-key.md b/.changeset/rate-limit-per-access-key.md
diff --git a/.changeset/remember-side-panel-tab.md b/.changeset/remember-side-panel-tab.md
diff --git a/.changeset/select-star-error-state.md b/.changeset/select-star-error-state.md
diff --git a/.changeset/series-limit-groupby-and-compare-fixes.md b/.changeset/series-limit-groupby-and-compare-fixes.md
diff --git a/.changeset/shorten-all-relative-time-units.md b/.changeset/shorten-all-relative-time-units.md
diff --git a/.changeset/span-attributes-key-column-overlap.md b/.changeset/span-attributes-key-column-overlap.md
diff --git a/.changeset/team-invitation-scoping.md b/.changeset/team-invitation-scoping.md
diff --git a/.changeset/terraform-iac-helpers.md b/.changeset/terraform-iac-helpers.md
diff --git a/.changeset/timestamp-type-detection-spellings.md b/.changeset/timestamp-type-detection-spellings.md
diff --git a/.env b/.env
@@ -8,8 +8,8 @@ NEXT_ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-all-in-one
 ALL_IN_ONE_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-all-in-one
 NEXT_OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=clickhouse/clickstack-otel-collector
 OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB=hyperdx/hyperdx-otel-collector
-CODE_VERSION=2.33.0
-IMAGE_VERSION_SUB_TAG=.33.0
+CODE_VERSION=2.34.0
+IMAGE_VERSION_SUB_TAG=.34.0
 IMAGE_VERSION=2
 IMAGE_NIGHTLY_TAG=2-nightly
 IMAGE_LATEST_TAG=latest

diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md
@@ -1,5 +1,70 @@
 # @hyperdx/api
 
+## 2.34.0
+
+### Minor Changes
+
+- fa73b84c: feat(mcp): add `clickstack_emerging_signals` MCP tool — a two-window Drain pattern novelty detector that set-differences mined log/event patterns between an earlier baseline window and a current window to surface what is newly emerging or has disappeared. Shares the Drain sample-and-mine pipeline with `clickstack_event_patterns` via an extracted `mineWindowPatterns` helper, and keys patterns across windows with a `normalizeTemplate` helper.
+- 97ca34df: feat: Allow configuring a `series` table for accelerating metrics
+- f9c52445: feat: add /v1/prometheus/query_exemplars, and harden the Prometheus proxy
+
+  Adds a `query_exemplars` route that proxies to Prometheus's native
+  `/api/v1/query_exemplars` for Prometheus-backed connections, and answers with an
+  empty success for ClickHouse-backed ones, where exemplars are read from the metric
+  table instead.
+
+  Three fixes to the shared proxy while adding a route to it:
+
+  - Responses now carry `X-Content-Type-Options: nosniff`, set before anything can
+    return so the proxy's own error bodies get it too, and the upstream content-type
+    is never forwarded — every response is relabelled `application/json`. The
+    connection host is member-configured, so its response body is untrusted output on
+    our own origin, and an allowlist is easy to slip past: `application/json,
+text/html` clears a prefix-anchored JSON test while the browser keeps the last
+    media type.
+  - A client that navigates away mid-body no longer counts as a backend error.
+  - Proxy failures increment `prometheusQueryErrors`. `proxyToPrometheus` handles its
+    own failures and returns normally, so the callers' `catch` never ran and all four
+    proxied endpoints reported zero errors while still recording duration. Counted on
+    5xx only, so a user's malformed PromQL does not read as a backend fault.
+  - The exemplar window is bounded by narrowing rather than rejecting, so a wide
+    dashboard range still works.
+
+- 1af1998c: Add Terraform helpers for adopting existing HyperDX resources with the ClickHouse provider. An "Export to Terraform" button on dashboards, saved searches, and saved-search alerts shows a ready-to-paste `import {}` block plus collapsible provider setup, and a team settings section ("API & Agents") downloads an import file covering dashboards, alerts, saved searches, sources, connections, and webhooks.
+
+  Dashboards carrying a tile the provider cannot represent, and PromQL sources, are excluded from the export and reported as skipped — in the UI and in the generated file. The provider reads a dashboard back through the external API v2, which either drops such a tile or substitutes an empty line chart, and writes tiles back whole, so importing one would destroy that tile on the next apply.
+
+  Import-only by design: resource configuration is generated by `terraform plan -generate-config-out`, which reads through the provider, rather than by HyperDX — the external API's dashboard serialisation is a field allowlist, so generating `dashboard_json` from it could silently drop tile settings on apply. Tile alerts are excluded because the provider models only saved-search alerts.
+
+  Terraform addresses are derived from each resource's id, not its name, so renaming a resource in HyperDX and re-exporting does not produce a destroy-and-recreate plan. The generator lives in `@hyperdx/common-utils` so the API can produce the same artefact the UI does. The manifest endpoint caps each listing at 1000 rows and reports which types were capped, so a very large team is told its export is partial rather than silently receiving one.
+
+  Also redacts `Authorization` and `Cookie` headers from API request logs.
+
+### Patch Changes
+
+- 3f87fe4b: Return 404 when updating a missing alert.
+- 94d028c8: Return a not-found response when updating a missing dashboard.
+- a794562d: Clear stale source-specific alert references when changing alert source.
+- 2d78083a: fix: Expose `seriesLimit` via external API and MCP
+- 1c3be6f0: Key the external API and MCP rate limiters on the access key, not the raw
+  `Authorization` header
+
+  `validateUserAccessKey` accepts any text before `Bearer `, so a single access
+  key authenticates under unlimited header spellings. The limiter bucketed on the
+  header value, so varying that prefix handed each request a fresh quota. Requests
+  that carry no usable access key now fall back to the client IP.
+
+- 1af1998c: Scope `DELETE /team/invitation/:id` to the caller's team. It previously deleted by id alone, so any authenticated user could revoke another team's pending invitation if they knew its id. Unknown or out-of-team ids now return 404.
+- Updated dependencies [ed9d9a67]
+- Updated dependencies [c97789a0]
+- Updated dependencies [2468b256]
+- Updated dependencies [97ca34df]
+- Updated dependencies [6a35df06]
+- Updated dependencies [d1c669dc]
+- Updated dependencies [1af1998c]
+- Updated dependencies [b082f700]
+  - @hyperdx/common-utils@0.25.0
+
 ## 2.33.0
 
 ### Minor Changes

diff --git a/packages/api/package.json b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperdx/api",
-  "version": "2.33.0",
+  "version": "2.34.0",
   "license": "MIT",
   "private": true,
   "engines": {
@@ -12,7 +12,7 @@
     "@braintree/sanitize-url": "^7.1.1",
     "@clickhouse/client-common": "1.23.0-head.fae5998.1",
     "@esm2cjs/p-queue": "^7.3.0",
-    "@hyperdx/common-utils": "^0.24.1",
+    "@hyperdx/common-utils": "^0.25.0",
     "@hyperdx/node-opentelemetry": "^0.9.0",
     "@hyperdx/passport-local-mongoose": "^9.0.1",
     "@modelcontextprotocol/sdk": "^1.27.1",