ClickHouse/ClickStack @hyperdx/api@2.44.0

on GitHub

Minor Changes

• cd0e9ed: feat: add optional titleEmoji webhook option; false removes the emoji prefix from notification titles sent through that webhook

• 5b0d074: feat: self-instrument with @clickhouse/clickstack-node and
  @clickhouse/clickstack-browser instead of @hyperdx/node-opentelemetry and
  @hyperdx/browser

  HyperDX's own telemetry changes shape. HTTP spans use the stable semantic
  convention keys (http.request.method, http.response.status_code,
  url.full). pino records come from the @opentelemetry/instrumentation-pino
  scope with real severity numbers instead of the node-logger scope with
  severity number 0. Console capture covers every console call in the API, and
  browser console output is recorded as log records instead of spans. Uncaught
  exceptions are recorded as FATAL log records, and API errors as an exception
  event on the Express span instead of a separate error span.

  Browser telemetry records the user as user.id, user.email and user.name
  instead of userEmail and userName, keeps the team name as teamName, and no
  longer records a user navigated action. Browser fetch and XHR spans no longer
  record request and response headers or bodies. Browser sessions restart once
  after the upgrade. The per-signal browser endpoints and
  NEXT_PUBLIC_OTEL_RESOURCE_ATTRIBUTES work as before. Browser traces and logs
  are now sent gzip-compressed every 5 seconds. If the browser sends to a
  collector other than ClickStack's, its CORS allowed_headers must be "*" or
  include content-type and content-encoding (and authorization), and a proxy
  in front of it must forward Content-Encoding unchanged.

  The Next.js server now sends its own telemetry in production builds too, not
  only under next dev, when HYPERDX_API_KEY or OTEL_EXPORTER_OTLP_HEADERS is
  set. HDX_EXPORTER_ENABLED=false turns it off along with browser telemetry. It
  reports under its own service name, the configured one plus -next
  (hdx-oss-app-next in the docker-compose app service and when no name is
  set), so its spans stay apart from the API's and the browser's. The HyperDX
  images now default OTEL_SERVICE_NAME to hdx-oss-app. Each /api request
  adds Next.js server spans for the proxy hop. Requests for build and public/
  assets, such as /_next/static/*, /__ENV.js and /pyodide/*, are not traced.

  HYPERDX_API_KEY still enables self-instrumentation. Without
  OTEL_EXPORTER_OTLP_ENDPOINT, server-side self-telemetry now goes to
  http://localhost:4318 instead of https://in-otel.hyperdx.io, so set the
  endpoint explicitly. HDX_NODE_* variables are no longer read. For request
  headers and bodies set OTEL_INSTRUMENTATION_HTTP_CAPTURE_HEADERS_* and
  CLICKSTACK_CAPTURE_HTTP_BODY.

• 349fc21: feat(mcp): add clickstack_describe_table to list the tables in a database and describe a table that is not a registered source (columns, keys, engine, skipping indices, approximate size, optional row sample)

• 0eec5e1: feat: Describe PromQL sources in MCP and hide them when PromQL is disabled

  clickstack_describe_source now returns the label names and metric names of a PromQL source, from either a ClickHouse TimeSeries table or a Prometheus-compatible endpoint, instead of a column schema. clickstack_list_sources and clickstack_describe_source show which backend a PromQL source uses, and for TimeSeries tables explain how to read them with clickstack_sql. Prometheus endpoint sources no longer show their placeholder table. When ENABLE_PROMQL is off, MCP hides PromQL sources from listing, describing and deleting, and clickstack_save_source no longer accepts kind: "promql".

• 95fa364: feat(mcp): support setting a dashboard's savedFilterValues via the MCP dashboard tools

• 0b7926d: feat: Team members can create team-owned API keys with a description and expiry that keep working after their creator leaves.

• c792850: feat: filter the v2 list alerts endpoint by tag, search, source and state

Patch Changes

• 30b1494: feat: add an internal extension point for alert detection strategies; threshold alerts are evaluated as before, and the alerts.evaluate metric now carries an alert_evaluator attribute

• 0453aa1: fix: A grouped alert whose group vanishes from the data now resolves with the group's values in {{attributes.*}} (alert title and message) and {{var.*}} (webhook body)

• 5b0d074: fix: let browsers cache the collector's CORS preflights for 10 minutes

  The OTLP receiver now answers preflights with Access-Control-Max-Age: 600.
  Without it, browsers cached a preflight for only 5 seconds, which is how often
  the browser SDK exports, so about half of its requests were preflights.

• 769c0de: fix: ignore team and createdBy in dashboard and saved search PATCH bodies so they can't be moved to another team or have their owner rewritten

• 9269f77: fix: "Denoise results" now removes noise on typical data. A pattern now counts as noisy above 5% of sampled events instead of 10%, which often matched nothing. Patterns that include error or warning lines are never hidden. The MCP denoise option uses the same 5% threshold. Denoise also mines the source's body column instead of the last table column, removes ANSI-colored rows that match a noisy pattern, says when results can't be denoised, and shows hidden patterns as a short summary with a shortened, expandable list.

• 48c8379: docs: Document minAutoGranularity on metric and PromQL sources in the external
  API

  GET, POST and PUT /api/v2/sources already accepted and returned
  minAutoGranularity, but the OpenAPI spec omitted it, so clients generated from
  the spec dropped or rejected the field.

• 6425332: perf: PromQL label lookups with match[] read only the matched metrics' tags
  rows when every selector names its metric

• 6310023: fix: give clickstack_save_source's highlightedRowAttributeExpressions parameter a real type in the MCP tool schema (it rendered as an untyped $ref), and set annotations.title on every MCP tool

• 5584f84: fix: make clickstack_event_patterns drill-down snippets executable

  Each pattern's whereSnippet is now a SQL predicate (whereLanguage: "sql") that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to clickstack_search returns the pattern's events. Before, a template like Sending <*> rows produced Body:"Sending rows", which matched nothing, and map fields produced Lucene that failed to parse. bodyExpression now also accepts JSONExtractString(<column>, '<key>', ...) to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries.

  clickstack_event_patterns, clickstack_emerging_signals and dashboard event-pattern tiles now apply the log source's tableFilterExpression, so their counts can drop for sources that set one. minePatterns now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit.

• 253a690: docs: MCP tool descriptions and the query guide now recommend the quoted Lucene
  form field:"value" for exact matches, and bare terms or phrases for log body
  text, so agents keep the primary key and the text index

• 66e3941: feat: MCP query_tile and query_tiles run PromQL tiles against Prometheus endpoints and ClickHouse TimeSeries tables

• 7e85229: feat: MCP clickstack_promql tool runs PromQL against a PromQL source, and the MCP prompts and instructions cover PromQL sources, tiles and label filters while PromQL is enabled

• 9093282: fix: Refuse Prometheus endpoint responses over 8 MB in MCP PromQL label lookups and queries, instead of buffering them whole

• 53bf540: fix: MCP query_tile returns PromQL table and histogram heatmap tiles in the rows the dashboard draws

• 917c9ca: feat: MCP dashboard tools read and write PromQL tiles and PROMETHEUS_LABEL filters when PromQL is enabled, and hide but keep them when it is disabled

• d08b2fa: feat(mcp): clickstack_sql accepts a queries array to run up to 10
  independent queries in parallel under a shared 60s deadline. Each query reports
  its own ok/error/timeout status, so one failing query does not fail the
  others. Single-query calls with sql behave as before.

• a13c80e: feat(mcp): clickstack_table takes optional limit and having, and orders grouped results by the first select item, descending, when no orderBy is given

• 0262822: fix: MCP tool responses that are over the size budget now shorten long strings with a …(+N chars) suffix instead of replacing them, say what was trimmed in trimNotes, and clickstack_event_patterns / clickstack_emerging_signals drop samples and shorten long patterns before cutting whole patterns, so the requested topN survives when it can

• 442d6df: fix: refresh cached table columns after 5 minutes

  The shared metadata cache kept each table's DESCRIBE result for the life of
  the process, so the API did not see columns added with ALTER TABLE, such as
  new MATERIALIZED columns, until it restarted. Cached columns now expire after 5
  minutes. Other cached metadata is unchanged.

• eb2439e: fix: leave metric points with no recorded value out of charts and alerts

  When a scraped series goes away or a scrape fails, the collector's prometheus
  receiver sends a point flagged "no recorded value" (a Prometheus staleness
  marker), and the ClickHouse exporter stores it as zeros. Metric charts and
  alerts read it as a real value: a gauge's min and avg dropped and count
  included the series that went away, and a counter or histogram that came back
  after the marker counted its whole total again. Metric queries now skip points
  with this flag.

• 0eec5e1: fix: Authenticate to Prometheus connections whose host includes credentials

  A Prometheus connection host such as http://user:pass@prometheus:9090 made every PromQL query fail with "Failed to reach Prometheus", because fetch rejects URLs that carry credentials. The credentials are now sent as a Basic auth header.

• 0a5237e: fix: reject alerts on dashboard tiles the alert checker never evaluates (PromQL
  tiles, and builder tiles with unsupported display types), and drop them when a
  dashboard is saved

• b7b4d95: fix: update systeminformation to 5.33.19

  The root resolutions pin let the lockfile keep systeminformation 5.30.7, which
  has known command injection advisories, including two high-severity ones in
  networkInterfaces() on Linux (GHSA-5xpp-75jx-m839, GHSA-hvx9-hwr7-wjj9). The
  API installs it through @opentelemetry/instrumentation-host-metrics, which
  asks for ^5.31.6, but the old pin held it at 5.30.7. The pin now starts at
  5.33.19, the newest 5.x release, which fixes all of them.

• b1d4e60: fix: PromQL label lookups (dashboard variables, label autocomplete) now work on TimeSeries tables of schema version 8, the default from ClickHouse 26.10. These keep each series' time range in a separate time ranges table instead of the tags table's min_time/max_time, so match[] failed with "requires store_min_time_and_max_time = 1" and time-bounded lookups read the whole tags table.

• ef56bd7: fix: usage stats job no longer fails ClickHouse auth on password-protected
  connections

• 90302c7: fix: Block generic and incident.io webhooks whose hostname resolves to a private or reserved address. The check runs on the address actually dialed, so it also covers DNS rebinding. Self-hosted setups that send webhooks to internal hostnames must add them to WEBHOOK_HOSTNAME_ALLOWLIST.

• Updated dependencies [142c9cc]

• Updated dependencies [cd0e9ed]

• Updated dependencies [9269f77]

• Updated dependencies [e2754d2]

• Updated dependencies [22f824c]

• Updated dependencies [6425332]

• Updated dependencies [d0dd06f]

• Updated dependencies [5584f84]

• Updated dependencies [41b2b74]

• Updated dependencies [442d6df]

• Updated dependencies [eb2439e]

• Updated dependencies [0b7926d]

• Updated dependencies [0a5237e]

• Updated dependencies [78143c8]

• Updated dependencies [b1d4e60]

  • @hyperdx/common-utils@0.34.0