Hatchet v0.110.5 ships a new dashboard overview page and onboarding flow. It also includes a set of security hardening fixes and a large batch of scheduler and engine performance work.
Highlights
- New overview page and onboarding flow: the dashboard opens on a redesigned overview page, with a new onboarding flow that walks through running your first task (#4986, #4990).
hatchet profile env: prints a shell export block of a profile'sHATCHET_CLIENT_variables, so credentials can be loaded into a shell without reading or pasting the token (#4972).- The embedded dashboard now signs in automatically instead of presenting a login screen (#4953).
Security
- API: payload visibility restrictions are now enforced on every endpoint that returns payload data, including events, logs, filters, and scheduled and cron runs (GHSA-hf2m-86fv-rjw5).
- API: workflow version lookups are scoped to the tenant, and versions that do not belong to the workflow in the path are rejected (#5098).
- Auth: changing a password now revokes the user's other sessions (#5093).
- Auth: the password and existing sessions are cleared when an OAuth login first verifies the account's email (#5094).
- Engine: tenant-supplied CEL expressions run under a cost limit and a deadline, so expensive expressions fail fast instead of consuming unbounded CPU and memory (#5092).
Fixed
- Engine: rate-limited tasks no longer get stuck holding filled concurrency slots, and a rate limit deadlock and an old-window charging bug are fixed (#4804, #5080).
- Engine: the scheduler replays capacity wakes lost while a missed item is in flight and replenishes starved actions on assignment misses (#5062, #5063).
- Engine: durable DAGs no longer get stuck without recovering, and cancelling a DAG now cancels its children (#4944, #5001).
- Engine: workflow-level concurrency and on-failure tasks are handled correctly for DAG runs (#5073, #5123).
- Engine: large durable fan-outs are faster, with smaller child write batches, cheaper hot-path queries, and primary-key lookups for satisfied durable entries (#5026, #5031).
- Engine: replaying a task upserts its input instead of silently skipping the write when the payload row is missing (#5096).
- Engine: idempotent runs wait for trigger slots (#4755).
- Engine: liveness probes no longer check the database and message queue, so a dependency blip does not restart healthy pods (#5028).
- Engine: partition creation reattaches invalid parent indexes and treats deadlocks during reattach as lock conflicts (#5021, #5081).
- Engine: payload partitions get unique constraints, only non-empty payloads are written, and the payload partition job runs in date order with correct bounds (#4988, #5002, #5004, #5041).
- Engine: the trigger path skips statements that carry no data, the assignment flush is a single statement, and workflow-filtered run lists are indexed (#5045, #5061, #5064).
- Engine: bumped to Go 1.26.7 to fix an h2c connection bug (#5033).
- API: the per-request gRPC client in the API proxy is closed after use (#5078).
- Go SDK: a failed stream reconnects from the generation that failed, and never twice for one failure (#5057).
- Dashboard: improved polling behavior and loading states, and portaled menus stay above dialogs (#5020, #5054).
What's Changed
- feat: embedded UI autologin by @abelanger5 in #4953
- ci: cli only release without changelog entries by @mnafees in #4971
- chore: Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in /examples/go/embedded by @dependabot[bot] in #4978
- chore: Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.43.0 to 1.45.0 in /examples/go/embedded by @dependabot[bot] in #4979
- feat(cli): add 'hatchet profile env' for loading profile credentials by @abelanger5 in #4972
- chore: Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.43.0 to 1.45.0 by @dependabot[bot] in #4977
- chore: Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.43.0 to 1.45.0 in /examples/go/embedded by @dependabot[bot] in #4980
- fix(engine): locking issue race condition on durable spawn / wait by @mrkaye97 in #4950
- fix(engine): durable dag getting stuck and not recovering by @mrkaye97 in #4944
- feat(python): make the sync result poll interval configurable by @grutt in #4982
- fix(engine): add
is_dag_operatorcolumn tov1_dags_olapby @mrkaye97 in #4984 - chore(engine): noise dag error by @mrkaye97 in #4985
- feat: new onboarding flow and overview page by @abelanger5 in #4986
- fix: move "Run your first task" footer into the resources tab in overview by @abelanger5 in #4990
- fix(engine): probe v1_task by primary key when resolving an external id by @grutt in #5000
- fix(engine): order payload partition job by partition date ascending by @mrkaye97 in #4988
- fix(scheduler): unstick rate-limited tasks holding filled concurrency slots by @grutt in #4804
- fix(engine): wait for trigger slots on idempotent runs by @grutt in #4755
- chore(engine): add more spans inside
try-assign-batch+ disable JIT on a few queries by @mrkaye97 in #4947 - fix(engine): add unique constraints to individual payload partitions by @mrkaye97 in #5002
- feat: migrate engine protocol to ConnectRPC by @abelanger5 in #4987
- fix(engine): only write non-empty payloads to payload table by @mrkaye97 in #5004
- chore(engine): remove payload duplicate row check by @mrkaye97 in #5008
- feat(python): add slot usage to worker health check endpoints by @mrkaye97 in #5003
- fix(engine): merge conflicts by @mrkaye97 in #5010
- feat(engine): engine-side gRPC operator support for out-of-process operators by @abelanger5 in #4910
- ci(python): improve some flaky tests by @mrkaye97 in #5011
- fix(engine): analyze more tables by @mrkaye97 in #5015
- fix(engine): use an upsert to serialize dag operator status updates more by @mrkaye97 in #5012
- chore(engine): remove payload fallback error logs by @mrkaye97 in #5013
- fix(engine): propagate more dag metadata to runs table on update by @mrkaye97 in #5017
- fix: Dag operator cancels weren't cancelling children by @juliusgeo in #5001
- fix: export internal symbols in package
operatorclientby @mnafees in #5018 - fix(engine): reattach invalid parent indexes on partition create by @mrkaye97 in #5021
- fix(dashboard): improved polling behavior and loading states by @mrkaye97 in #5020
- chore(engine): add error log around webhook ingest failure for more context by @mrkaye97 in #5023
- docs: add to faq, move idempotency out of beta by @mrkaye97 in #5024
- fix(engine): look up satisfied durable entries by primary key by @grutt in #5026
- fix(engine): drop database and queue checks from liveness probes by @igor-kupczynski in #5028
- chore(engine): remove one more noisy log by @mrkaye97 in #5029
- fix(engine): bump to Go 1.26.7 to fix h2c connection bug by @abelanger5 in #5033
- fix(engine,python): improve performance on large durable fanouts by @mrkaye97 in #5031
- fix(ts-sdk): emit the v0 deprecation warning on use, not on import by @abelanger5 in #5039
- fix(engine): payload job bounds, noisy logs by @mrkaye97 in #5041
- chore: Bump github.com/hatchet-dev/hatchet from 0.105.0 to 0.106.1 in /examples/go/embedded by @dependabot[bot] in #5035
- chore: Bump github.com/hatchet-dev/hatchet from 0.105.0 to 0.106.1 in /sdks/go/examples/embedded by @dependabot[bot] in #5019
- chore: Bump the npm-dev-deps group across 2 directories with 4 updates by @dependabot[bot] in #4992
- chore: Bump the github-actions group with 3 updates by @dependabot[bot] in #4991
- fix: show tag-fetch errors when bumping versions by @igor-kupczynski in #5042
- chore: Bump the go-modules group across 1 directory with 20 updates by @dependabot[bot] in #5043
- fix: Typescript SDK lint errors by @abelanger5 in #5044
- feat: pay-as-you-go billing (usage page + retention UI) by @grutt in #4913
- refactor: support ConnectRPC-based unary RPCs for Typescript SDK by @abelanger5 in #5016
- fix(dashboard): small last mile billing changes by @grutt in #5046
- fix(dashboard): keep portaled menus above dialogs by @grutt in #5054
- docs: fix technical SEO audit findings by @abelanger5 in #5049
- fix: don't log when logLevel is set to
OFFby @abelanger5 in #5053 - chore: ensure that http/1.1 is always turned on for unary RPCs by @abelanger5 in #5014
- fix: update the testing harness engine to use actual version by @abelanger5 in #5052
- docs: point changelog links at final URLs instead of redirects by @abelanger5 in #5055
- feat(ts-sdk): add the /core client for runtimes without gRPC by @abelanger5 in #5048
- chore: Bump step-security/linkinator-action from 1.11.2 to 2.4.5 in the github-actions group by @dependabot[bot] in #5060
- chore: Bump the go-modules group with 8 updates by @dependabot[bot] in #5059
- fix(dashboard): tighten billing limits and the upgrade gate by @grutt in #5066
- fix(go-sdk): race condition in RetrySend on streaming listeners by @abelanger5 in #5057
- perf(trigger): skip statements that carry no data on the trigger path by @abelanger5 in #5061
- fix: race condition in operator session test by @abelanger5 in #5069
- ci: retry 5xx and connection failures in the auth gate by @igor-kupczynski in #5071
- fix: attach workflow-level concurrency to the orchestrator step on the DAG operator path by @grutt in #5073
- chore(pre-commit): lint only changed Go packages in golangci-lint hook by @igor-kupczynski in #5074
- fix: close the per-request gRPC client in the API proxy by @grutt in #5078
- fix(scheduler): requeue when we replenish while queue items are in
q.unackedby @abelanger5 in #5062 - fix: fix rate limit deadlock, fix rate limit charge old window bug by @juliusgeo in #5080
- test(scheduler): fix lostWakeQueueRepo GetTaskRateLimits signature by @igor-kupczynski in #5083
- fix(engine): treat deadlocks in partition index reattach as lock conflicts by @grutt in #5081
- fix(analytics): preserve counts when flush evicts an idle key by @abelanger5 in #5077
- fix: deflake tests by @abelanger5 in #5076
- fix: deflake the streaming test; block the fake Recv until an event or EOF by @abelanger5 in #5087
- ci(load-online-migrate): run branch migrations against the base engine by @abelanger5 in #5079
- perf(olap): index workflow-filtered run lists by @igor-kupczynski in #5045
- fix(engine): bound runtime cost and duration of tenant-supplied expressions by @grutt in #5092
- fix(auth): revoke other sessions when a user changes their password by @grutt in #5093
- fix(engine): upsert task input on replay instead of UPDATE-only overwrite by @grutt in #5096
- fix(api): scope workflow version lookups to the tenant by @grutt in #5098
- fix(auth): clear password and sessions when an OAuth login first verifies the email by @igor-kupczynski in #5094
- ci: modify load tests to run with and without
-raceflag, remove rampup test by @abelanger5 in #5091 - fix: add automatic retry for flaky package installations by @abelanger5 in #5086
- fix: e2e typescript tests should measure workflow-level concurrency from task timestamps by @abelanger5 in #5089
- fix: flaky test when querying results for durable replay by @abelanger5 in #5088
- fix(e2e-tests): assert durable callback replay across all mids, not per root by @abelanger5 in #5107
- feat(dashboard): archive organizations from settings by @jbsouvestre in #5106
- feat: durable streams by @juliusgeo in #5072
- feat(dashboard): add a danger zone to tenant settings by @jbsouvestre in #5111
- fix(scheduler): properly replenish starved actions on assignment misses by @abelanger5 in #5063
- perf(scheduler): merge the assignment flush into one statement by @abelanger5 in #5064
- fix(test): settle the replay before flushing the next delta by @abelanger5 in #5113
- fix(operatorclient): race condition on send error after replay by @abelanger5 in #5117
- fix(engine): use operator for single-task dags with on-fail task by @mrkaye97 in #5123
- chore: regenerate examples by @github-actions[bot] in #5124
- chore: Bump next from 16.3.3 to 16.3.6 in /frontend/docs by @dependabot[bot] in #5100
- chore: Bump axios from 1.18.1 to 1.20.0 in /frontend/app by @dependabot[bot] in #5099
- fix(engine): lock durable event log files before satisfying entries by @vladimir-encord in #5102
- chore: fix dependabot alerts by @mnafees in #5130
- chore: Bump the go-modules group with 5 updates by @dependabot[bot] in #5125
- chore: Bump the npm-dev-deps group across 2 directories with 4 updates by @dependabot[bot] in #5126
- chore: Bump the github-actions group with 3 updates by @dependabot[bot] in #5127
- fix(engine): misleading durable exec error by @mrkaye97 in #5133
- fix: rename durable streams migration by @juliusgeo in #5134
- chore: changelog for next OSS release by @mnafees in #5129
New Contributors
- @vladimir-encord made their first contribution in #5102
Full Changelog: v0.107.0...v0.110.5