Skip to content

v0.22.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Aug 18:01
· 5 commits to main since this release
v0.22.0
959e0a4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes 170 issues found by a full-codebase review, each confirmed by an independent verification pass. Build, vet, and the race-enabled test suite pass across all 35 packages, with 269 tests added.

⚠️ Before upgrading

  • Back up your data directory. Migration 000002 rewrites timestamp columns in place on existing installs. It is guarded and idempotent, and was verified against a simulated legacy database — but it does modify your data.
  • Downgrading is not supported after this release. Newly sealed chunks use format v2. This release still reads v1 files, so your existing data is fine, but older binaries cannot read anything written from now on.

Critical fixes

  • Live servers were being marked offline on every sweep. Timestamps written by bun (2006-01-02 15:04:05-07:00) were compared against RFC3339, and ' ' sorts below 'T', so any same-day heartbeat compared below the cutoff. Fixed as one systemic root cause, which also repaired MCP activity stats, session expiry, and audit pruning.
  • A single log field over 64KB corrupted an hour of logs. The WAL length prefix was written as uint16 while the full bytes were appended, desynchronizing the record and everything after it.
  • logs stats could be made to hang and exhaust memory — bucket_interval accepted 0s and negative durations.
  • MySQL, Redis, Turso and server-metrics connectors could never be created; a schema constraint rejected them even though the tool advertised them.

Security

  • Closed SQL injection in the MCP database schema action, and hardened the read-only SQL guardrail against comment-, CTE- and INTO OUTFILE-based bypasses.
  • Stopped leaking connector credentials and the ingest API key to non-admin MCP clients, and gated deep_capture and connector write actions behind admin.
  • Environment scope is now enforced as an authorization boundary across MCP resources, overview, and error tools — a staging-scoped token no longer receives production data.
  • API-key auth now fails closed on a database error, proxy-asserted admin requires an explicit opt-in, and rate limiting can no longer be bypassed via X-Forwarded-For.

Reliability

  • Logs survive restarts: the WAL is sealed on shutdown, orphaned previous-hour WALs are recovered, and a torn tail no longer prevents the server from booting.
  • Whole-range request queries are roughly 1900× faster (1m45s → ~55ms for 20k rows).
  • The watch engine no longer fires false alerts from an ignored query filter or unsatisfiable delta thresholds, and a malformed watch no longer causes a retry storm.
  • Query tools no longer silently drop advertised filters or narrow the search window to the last hour — the class of bug where an incident from yesterday read as "nothing happened".

Notable behavior changes

  • EXPLAIN ANALYZE is rejected rather than silently failing (it executes the statement, which the read-only guardrail exists to prevent).
  • opentrace seed no longer deletes your logs unless OPENTRACE_SEED_RESET=true.
  • Proxy-asserted admin requires OPENTRACE_TRUST_PROXY_AUTH_ADMIN=true.
  • Unknown subcommands and unhealthy status now exit non-zero instead of silently succeeding.

Full details: #16

Assets 7
Loading