Release v0.4.10

This is the first published release on this page; the tags go back further — the
full history lives in CHANGELOG.md.

Gotcha is a self-hosted observability platform in a single Go binary: error
tracking, traces, metrics, profiles and uptime monitoring on top of PostgreSQL +
ClickHouse. It accepts the Sentry SDK wire protocol and OTLP, and runs on a
2 vCPU / 2 GB VPS.

v0.4.10 closes out the 0.4.x stabilization pass — two audits of the whole
product surface (operations, security, accessibility, i18n) turned into fixes,
a CodeQL-reported hardening of the redirect guard, and a short train of
follow-up patches (0.4.5–0.4.10) polishing notifications, networking knobs and
form controls.

Highlights of 0.4.2 → 0.4.10

Operations

• The compose stack is bounded: memory ceilings for the app and both databases,
  container healthchecks with start_period, a hardened app container
  (read-only FS, dropped capabilities, no-new-privileges). The heap ceiling is
  derived from the cgroup limit, so the OOM killer no longer eats buffers.
• Liveness and readiness are separate now: /healthz answers while the process
  serves HTTP, readiness moved to /readyz. Update anything that watched
  /healthz for readiness.
• --migrate-force recovers an interrupted migration without a separate
  migrate binary; schema versions carry a backward-compatibility marker, so
  rolling back a release no longer requires restoring from a backup.
• Retention follows the lifetime of each data kind (GOTCHA_METRIC_RETENTION_DAYS,
  GOTCHA_PROFILE_RETENTION_DAYS, GOTCHA_INCIDENT_RETENTION_DAYS); 0 now
  really means "keep forever".
• New knobs for constrained networks: GOTCHA_TELEGRAM_API_BASE points Telegram
  delivery at a custom Bot API server, GOTCHA_NET_MTU sets the container
  network MTU for tunnel scenarios (the docs now also explain which side of an
  MTU mismatch you can actually control).

Correctness

• Transaction quota is charged for what is stored, not what arrived — a project
  sampling at 0.1 used to pay ten times over.
• Regression durations were shown a thousand times too high (µs read as ms) in
  cards, emails, webhooks and Telegram; migration 0030 recomputes affected rows.
• Events with NUL bytes in string fields are stored instead of silently lost.
• Outbox claims, alert throttling and retry times are computed by the database
  clock — a process with a fast clock could send an alert twice.

Security

• Removing a member from an organization now revokes their teams' project access
  too; the invariant moved into the schema.
• Invite-mode registration requires the token from the invite link, not just a
  matching email.
• OTLP/JSON bodies nested deeper than 100 levels are rejected instead of
  crashing the process; span attributes are capped before allocation.
• 0.4.4: the redirect guard at the Location header rejects control characters,
  closing a WHATWG-URL tab/newline bypass of the // and /\\ checks
  (CodeQL go/unvalidated-url-redirection; no reachable exploit existed — the
  guard no longer depends on its callers).

Notifications

• Notifications speak one operator-chosen language (GOTCHA_LOCALE), with
  human-readable subjects everywhere; invitation emails name the organization
  and the inviter.
• A channel can be marked as inside the organization's perimeter: it then
  receives full event details regardless of address format, and shows a
  "With details" badge in channel tables.

UX / a11y

• Every scrolling container is keyboard-reachable and announced to screen
  readers; availability-bar states are distinguishable without color vision.
• Checkboxes and radio buttons are custom-drawn for visibility and contrast
  compliance (browser defaults were illegible on the dark theme), with a
  dedicated layout for checkboxes that carry hints.
• Compact metric values (910M instead of 8e+08), honest sign-up copy per
  registration mode.

Docs: install, upgrade and configuration guides at
getgotcha.ru/en/docs.