github buggregator/server v2.6.0
on GitHub

40 minutes ago

Built with harnsy — the Buggregator team runs its AI agents in harnsy.

Before you upgrade

  • With SSO on, scripts that call the SMTP testing API must log in. The Sentry, profiler and SMTP testing APIs, attachment lists and GET /api/metrics now require a session; before, they answered without one. Scripts that read captured mail (/api/smtp/messages, /messages/wait, /codes and so on) must send X-Auth-Token. With auth off nothing changes. The WebSocket live feed now also needs the session token, so with SSO on use frontend 1.35.0 (bundled) or newer — an older UI loses live updates. SDK ingestion, /mock/, attachment downloads and Prometheus /metrics stay open. (#373, #374)

  • Sentry data moves to the default project. Sentry errors sent through a standard DSN (/api/1/...) and traces, logs and metrics stored before this version had no project. On first start, two migrations put them under default. Nothing is deleted. If you filter Sentry by project, look for older data under default.

  • Use the matching UI. This release bundles frontend 1.35.0. Clearing Sentry data for one project and reading traces, logs and metrics per project need both.

  • More database connections for file databases. With a file database, the server now opens up to 4 SQLite connections, so reads no longer wait behind writes. Set database.max_open_conns (or DATABASE_MAX_OPEN_CONNS) to 1 for the old behaviour. In-memory databases always use one connection.

  • A busy port now stops startup. If another mail catcher (Mailpit, MailHog) already uses port 1025, the server exits with smtp: listen on <addr>: … instead of running without SMTP. Free the port or move Buggregator to another one with tcp.smtp.addr (SMTP_ADDR). The same goes for the HTTP port 8000: the server exits with an error naming the address; change it with -http-addr or HTTP_ADDR. (#377, #385)

Added

  • Mock server. Requests to /mock/... get the response of the first matching rule: method + path → status, headers, body and an optional delay. Make rules in the UI, through the API, or in buggregator.yaml (handy for CI). Every request is still captured as an HTTP dump, together with what the mock sent or why no rule matched. (#362, #364, #367, fixes #332)
  • Dynamic mock responses. A mock rule with template: true builds its body and headers per request with Go templates: request values (path, query, headers, JSON body fields), fake data (fake "name", pick), loops (range repeat) and if, and a seed for the same fake data every time. Try a rule with POST /api/mocks/preview; GET /api/mocks/helpers lists the helpers. A render stops after 2 seconds or 1 MB. Rules without template work as before. (#380, #388)
  • Mocks from an OpenAPI spec. Import an OpenAPI 3.0/3.1 spec (YAML or JSON) and get one mock rule per operation, with the spec's examples or fake data built from the schemas. Through POST /api/mocks/import/openapi (a spec or a URL), the MCP tool mock_import_openapi, or at startup with mocks_openapi: in buggregator.yaml. A re-import replaces the rules of the same group. Swagger 2.0 is not supported. (#388)
  • MCP tools for mocks. MCP clients can list, create, change and try mock rules (mock_* tools). Writing is on by default; turn it off with mcp.mock_write: false / MCP_MOCK_WRITE=false. (#386, #388)
  • Xdebug proxy (off by default). Buggregator can sit between Xdebug and your IDE, show the paused session on a new read-only Xdebug page, and give MCP clients read-only tools for the same session. Turn it on with xdebug.enabled / XDEBUG_PROXY_ENABLED. (#363, #368, #371, #381)
  • Sentry filters. Exceptions, traces, logs and metrics can be filtered by project, environment and period; metrics by part of the name, logs by several levels. (#352, #360, #366, #369)
  • Live Sentry tabs. When a request stores Sentry logs, metrics or traces, the server sends one sentry.stored notice ({"project", "kinds"}) on the project's WebSocket channel, so the UI refreshes those tabs without waiting for an error event. Older UIs ignore the notice. Modules can now send notices of their own through the optional module.Broadcasting interface. (#372, #376, fixes #359) that were actually stored. (#372, #376, #386, fixes #359)
  • Event list limits (opt-in). /api/events and /api/events/preview accept limit, offset/page, from, to and window. There is no cap by default; pinned events come first. (#351)
  • zstd. Sentry envelopes compressed with zstd are accepted. (#350)
  • Install with one command. Linux and macOS: curl -fsSL https://raw.githubusercontent.com/buggregator/server/master/scripts/install.sh | sh. Windows (PowerShell): irm https://raw.githubusercontent.com/buggregator/server/master/scripts/install.ps1 | iex. The script picks the binary for your system, checks it against the release's new checksums.txt and installs it without sudo (~/.local/bin, or %LOCALAPPDATA%\Programs\buggregator on Windows). (#384)
  • Windows on ARM: releases now include a windows-arm64 binary. (#383)
  • Smaller macOS binaries: the VarDumper parser is now embedded compressed, so the macOS downloads are about 39–40 MB instead of 62–66 MB. (#382)
  • Docker: the image is also tagged with the major version, ghcr.io/buggregator/server:2. (#361, fixes #344)

Security

  • With SSO on, the Sentry, profiler and SMTP testing APIs, attachment lists and GET /api/metrics no longer answer without a session; before, anyone could read Sentry data or clear it with DELETE /api/sentry/all. (#373)
  • With SSO on, the WebSocket feed accepts a client only after it connects with a valid token; before, anyone could receive every live event. Sockets that never log in are closed after 10 seconds, and a logged-in socket is closed when its token expires (log in again to resume live updates). (#374, #377)
  • The server ignores X-Buggregator-Detected-Type and X-Buggregator-Detected-Project sent by a client; they are internal, and a client could use them to pick the handler or the project. Use X-Buggregator-Event / X-Buggregator-Project as documented. (#376)

Fixed

  • HTTP dumps of proxied requests keep the scheme (http/https), so the UI can copy them as cURL with the right URL. (#387)
  • Sentry PHP SDK 3.x / 4.x: transactions show their operation and status, including failed ones; Span v2 spans (for example gen_ai) are stored; messages with numeric parameters are no longer lost. An envelope with only non-feed items (sessions, client reports, check-ins, profiles) no longer creates an empty card in the feed. (#389)
  • Sentry events with ISO timestamps or non-string span data in nested items were dropped although the SDK got HTTP 200. (#349)
  • SMTP testing API: /api/smtp/messages/wait?project=… no longer returns on new mail of another project. (#379)
  • Clearing Sentry data now clears only the current project and keeps pinned events. (#365)
  • Live events of a project created after the page was opened now reach the page without a reload. (#370)
  • Sentry logs or metrics in an unexpected shape are now logged instead of being dropped silently; logs and metrics of the same timestamp keep a stable order. (#360)

Upgrade

Replace the binary or pull the new image; migrations run on start (000028–000034). Bundled UI: frontend 1.35.0.

Thanks to @tsan88 and @temp for their contributions, and to @marden and @ALameLlama for the ideas and reports.

Full Changelog: v2.5.0...v2.6.0

Check out latest releases or
releases around buggregator/server v2.6.0

Don't miss a new server release

NewReleases is sending notifications on new releases.

Get notifications