v1.3.1 — 6 New APM Integrations, Forensic Ingestion Security & Resilience Hardening

OpsKnight v1.3.1 introduces 6 new native observability and APM integrations, comprehensive forensic webhook security with constant-time HMAC validation, and core engine resilience hardening.

---

🚀 Added & Highlights

1. 🔌 6 New Native Observability & APM Integrations

Integration	Protocol / Method	Events Supported	Auto-Recovery / Deduplication
Zabbix	Webhook Media Type (JSON)	PROBLEM, RESOLVED, UPDATE	Native EVENT.ID / trigger_id deduplication & auto-close
PagerDuty Events API v2	REST (/api/v2/enqueue)	trigger, acknowledge, resolve	dedup_key mapping & drop-in routing key resolution
GitLab CI/CD	Pipeline Webhook	Pipeline failed, success, canceled	Branch & Commit SHA tracking with auto-resolve on rerun
Vercel Deployments	Deployment Webhook	deployment.error, deployment.ready	Project & Deployment ID auto-resolve on subsequent success
Nagios Core & XI	Macro Webhook / Script	Host/Service CRITICAL, WARNING, OK	Macro parsing (DOWNTIMESTART, flapping, SERVICESTATE)
Icinga 2	Notification Webhook	Host/Service State Transitions, ACK	State transition mapping with auto-resolve on OK

2. 🔐 Forensic Ingestion Security & Authentication

• Timing-Safe HMAC Verification: Constant-time crypto.timingSafeEqual signature checks and mandatory integration keys across all 24 webhook routes.
• SHA-256 Deduplication Hashing: Collision-proof 32-character SHA-256 fingerprinting replaces legacy 100-character string slicing.
• Replay Attack Defense: Outbound webhook timestamp binding (X-OpsKnight-Timestamp in HMAC payload) eliminates replay attack vectors.

3. 🛡️ Resilience Hardening & Runtime Core

• Circuit Breaker Concurrency Locking: halfOpenRequestInFlight locking prevents thundering herd spikes during downstream service recovery.
• 5-Minute Notification Deduplication: Rolling 5-minute window for alert and notification queue processing.
• Sequential Multi-Channel Fallback: Automated escalation chain (push -> sms -> whatsapp -> email) for High & Critical incidents.
• Server Action Navigation Handling: Clean Next.js navigation error propagation (isRedirectError, isNotFoundError) in server wrappers.
• Safe RBAC Default: Unauthenticated sessions safely fallback to VIEWER role with authenticated: false.

4. 📦 Official Organization Migration

• Repository and container packages migrated to ghcr.io/opsknight-labs/opsknight with public anonymous pull support.

---

Upgrading

Docker / Compose

docker pull ghcr.io/opsknight-labs/opsknight:v1.3.1
docker compose down && docker compose up -d

Kubernetes / Helm

helm upgrade opsknight opsknight/opsknight --set image.tag=v1.3.1

1. Deploy — database migrations run automatically on start.
2. Verify webhook endpoints in Settings → Integrations to ensure secret tokens / HMAC signatures are configured.

---

Full notes in CHANGELOG.md · Integrations Documentation

v1.2.0 — Slack ChatOps Incident War Rooms

Incidents now get a dedicated Slack channel with the responders already in it, so triage starts in the room rather than in a link.

Added

• Incident war rooms — a Slack channel per qualifying incident, with on-call responders auto-invited from the first three escalation steps, an incident command card, and an optional Jitsi / Zoom / Google Meet bridge
• 1-click actions — Acknowledge, Assign to Me, Resolve, straight from the card
• Slash commands — /incident ack | resolve | note | who | postmortem | help
• 📌 emoji pin sync — react to any message in a war room to capture it as an incident note; pinning is idempotent, so re-reacting will not duplicate it
• Slack app manifest generator — copy a manifest that configures every scope, Event Subscriptions, interactivity and the slash command in one step
• Signing secret in the UI, stored encrypted — no environment variable required
• Setup documentation for the whole flow, with a scope reference and a troubleshooting table keyed by symptom

Fixed

On-call resolution paged the entire schedule. hour12: false resolves to the h24 hour cycle on Node 20's ICU, reporting midnight as hour "24" and shifting start-of-day a full day early in zero-offset zones such as UTC. No block covered "now", so the safety net paged every member of the schedule instead of the person actually on call. Reproduced and verified fixed on the production runtime.

Also:

• Slack request signatures are verified and fail closed; a missing secret previously meant every unsigned request was trusted
• Server-side request forgery via response_url, which was fetched unvalidated
• "Assign to Me" could assign an incident to an arbitrary user when Slack resolution failed
• The Acknowledge button did not stop the escalation chain
• Slack button actions did not send the notifications their web equivalents send
• The incident timeline showed raw Slack IDs instead of names
• The war-room API required only authentication, not permission on the incident
• Manual Create War-Room and Archive were blocked by settings governing automatic behaviour
• Slack rate limits (429) crashed some paths and were swallowed on others
• Archived war rooms no longer read as active, no longer receive updates, and reopening an incident can provision a fresh channel

Changed

• Watchtower removed from the production compose file; image rollout is a deliberate action
• engines pins Node 20 to match the production image
• Pinned messages are saved as an incident note only, without a duplicate timeline event

Upgrading

Docker / Compose

docker pull ghcr.io/opsknight-labs/opsknight:v1.2.0
docker compose down && docker compose up -d

Kubernetes / Helm

helm upgrade opsknight opsknight/opsknight --set image.tag=v1.2.0

1. Deploy — migrations run on start
2. Enter the Slack Signing Secret in Settings → Integrations → Slack. Earlier releases stored a value in that field that was never a signing secret; the migration clears it, and Slack requests are rejected until the real one is provided
3. Apply the app manifest from Settings → Integrations → Slack, then reinstall the Slack app so the new scopes are granted

Full notes in CHANGELOG.md · Slack ChatOps setup guide

v1.1.0 - Jira Cloud Integration, SLA Engine Tier-2 & Master Key Security

🚀 OpsKnight v1.1.0: Jira Cloud Integration, SLA Engine Tier-2, Master Key Security & Normalized Postmortems

OpsKnight v1.1.0 is here! This release brings enterprise-grade Jira Cloud bi-directional synchronization, hardened Tier-2 SLA compliance, master encryption key security architecture, and normalized postmortem action items with real-time Jira badges.

---

✨ Highlights & New Features

1. 🔗 Bi-Directional Jira Cloud Integration

• Service-Owned Project Key Routing: Configure default Jira project keys per service (e.g. SCRUM, PAY, INFRA), with automatic fallback to organization-level defaults.
• Auto-Create Tickets from Incidents: Automatically create Jira issues for HIGH and MEDIUM severity incidents based on configurable rules.
• Real-Time Note & Event Synchronization: Notes, status updates, and timeline events posted on OpsKnight incidents automatically synchronize to linked Jira issues as comments.
• Timing-Safe HMAC Webhook Endpoint: Inbound Jira webhooks at POST /api/jira/webhook securely verify payloads using constant-time crypto.timingSafeEqual HMAC checks (x-jira-webhook-secret).
• Smart URL & Key Parsing: Supports pasting raw keys (SCRUM-4), lowercase keys (scrum-4), browse URLs (/browse/SCRUM-4), and board queries seamlessly.

2. 📋 Postmortem Action Items & Jira Link Badges

• Normalized Action Items Schema: Transitioned postmortem action items to dedicated first-class Prisma model with full audit logging.
• Live Jira Badges: Postmortem action items display clickable Jira badges (SCRUM-4 ↗) with live status and assignee tooltips.
• Immediate UI Revalidation: Corrected server action cache revalidation so Jira tickets render immediately without manual page reloads.

3. ⏱️ Tier-2 SLA Engine Hardening

• Query Protection: 180-day and 365-day query timeout bounds prevent unbounded database scans during rollup calculations.
• Timezone Parity: Business-hours SLAs respect local service timezones with holiday calendar support.
• Self-Healing Rollups: Automatic backfill ensures SLA breach metrics remain continuous and accurate across service migrations.

4. 🔐 Master Encryption Key Architecture

• 12-Factor Security Standards: Transited encryption key storage from database settings to the ENCRYPTION_KEY environment variable.
• Transparent Legacy Fallback: Automatic self-healing decryption for pre-existing credentials without data loss.

5. 📚 Documentation & Website v1.1 Parity

• Versioned Docs: docs/v1.1/ includes complete guides for Jira Cloud, Master Key Security, SLA Engine, and Postmortem workflows.
• Legacy Preservation: docs/v1/ remains 100% untouched for v1.0.0 self-hosted deployments.
• Automated Sync: Seamless CI/CD synchronization between application repo and marketing website.

---

📦 Installation & Upgrade

Docker / Compose

docker pull ghcr.io/opsknight-labs/opsknight:v1.1.0
docker compose down && docker compose up -d

Kubernetes / Helm

helm upgrade opsknight opsknight/opsknight --set image.tag=v1.1.0

v1.0.0

What’s Included

Incident Management

• Full lifecycle: OPEN → ACKNOWLEDGED → SNOOZED → SUPPRESSED → RESOLVED
• Incident timelines, notes, and resolution tracking
• Postmortems with action items

On‑Call Scheduling

• Rotation schedules with layers and timezones
• Overrides and coverage visibility
• On‑call ownership integrated with escalation

Escalation Policies

• Multi‑step escalation chains
• Repeat loops and escalation delays
• Integrated with schedules and notifications

Multi‑Channel Notifications

• Email, SMS, push, Slack, WhatsApp, webhooks
• Delivery tracking and notification preferences

Public Status Pages

• Real‑time service health updates
• Subscriber notifications
• Custom domains and API/RSS endpoints

Analytics & SLA Tracking

• MTTA/MTTR, SLA compliance, and incident trends
• Service health metrics and distribution breakdowns

Mobile PWA

• iOS/Android installable PWA
• Push notifications with incident context
• On‑call actions on the go

Integrations

• Prometheus, Datadog, Grafana, Sentry, CloudWatch
• Slack + generic webhooks
• Expandable integration framework

📦 Installation & Deployment

Docker / Compose

docker pull ghcr.io/opsknight-labs/opsknight:v1.0.0
docker compose up -d

Kubernetes / Helm

helm install opsknight opsknight/opsknight --set image.tag=v1.0.0

Documentation Coverage

• Getting Started
• Core Concepts (services, incidents, schedules, escalation)
• Integrations
• Administration (notifications, audit logs, retention, custom fields)
• API Reference
• Deployment
• Security
• Architecture
• Mobile

Notes

• No external dependencies required beyond Postgres (built‑in job queue)
• Community health files included (CONTRIBUTING, CODE_OF_CONDUCT, issue templates)