Skip to content

BlazeUp-AI/Observal](https:

v1.0.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agents antigravity claude-code cli-tool cursor cursor-ai
+13 more
evaluation insights kiro large-language-models litellm llm llm-evaluation llm-observability llmops monitoring observability playground self-hosted

Summary

AI summary

Updates 1.0.0] - 2026-05-23, Other, and Testing across a mixed release.

Full changelog

[1.0.0] - 2026-05-23

Added

  • instrument uv.lock (optic) (28dffa7)
  • instrument tests.test_optic (optic) (c30fd8e)
  • instrument ..pyproject.toml (optic) (b230772)
  • instrument observal-server.worker (optic) (ccdf746)
  • instrument observal-server.uv.lock (optic) (3eb96f6)
  • instrument services.webhook_signer (optic) (75af8f7)
  • instrument services.webhook_delivery (optic) (83467f8)
  • instrument services.versioning (optic) (6fe21cb)
  • instrument services.username_generator (optic) (4106f9e)
  • instrument services.strategic_insights (optic) (c20ccef)
  • instrument services.ssrf_guard (optic) (4efdec3)
  • instrument services.skill_validator (optic) (5e44909)
  • instrument services.skill_config_generator (optic) (a528c8a)
  • instrument services.session_ingest (optic) (6579efc)
  • instrument services.security_events (optic) (61f8745)
  • instrument services.secrets_redactor (optic) (4885150)
  • instrument services.sandbox_validator (optic) (db99915)
  • instrument services.sandbox_config_generator (optic) (056d3e2)
  • instrument services.retention (optic) (a7661a5)
  • instrument services.registry_telemetry (optic) (8a27417)
  • instrument services.optic (optic) (e86de6b)
  • instrument services.model_resolver (optic) (e0ea069)
  • instrument services.model_display (optic) (ce1a920)
  • instrument services.model_catalog (optic) (bcadf33)
  • instrument services.mcp_validator (optic) (257eeb0)
  • instrument services.log_buffer (optic) (5947f71)
  • instrument services.jwt_service (optic) (7069b63)
  • instrument services.ide.opencode (optic) (d34898e)
  • instrument services.ide.kiro (optic) (612792d)
  • instrument services.ide.helpers (optic) (e6ac8b3)
  • instrument services.ide.gemini_cli (optic) (b2b9d17)
  • instrument services.ide.cursor (optic) (512d267)
  • instrument services.ide.copilot (optic) (ff776df)
  • instrument services.ide.copilot_cli (optic) (a445302)
  • instrument services.ide.codex (optic) (b1331c2)
  • instrument services.ide.claude_code (optic) (d6562ba)
  • instrument services.ide_feature_inference (optic) (97f5b93)
  • instrument services.hook_install_generator (optic) (9719200)
  • instrument services.hook_config_generator (optic) (498d4cc)
  • instrument services.git_mirror_service (optic) (ab0cab2)
  • instrument services.events (optic) (e15fc12)
  • instrument services.editing_lock (optic) (6c44f88)
  • instrument services.dynamic_settings (optic) (be3ddf8)
  • instrument services.download_tracker (optic) (9812af8)
  • instrument services.demo_accounts (optic) (e3139de)
  • instrument services.crypto (optic) (5352c64)
  • instrument services.config_generator (optic) (3cfd429)
  • instrument services.component_version_extras (optic) (0ea4a0c)
  • instrument services.clickhouse.schema (optic) (1eab815)
  • instrument services.clickhouse.query (optic) (212192f)
  • instrument services.clickhouse.insert (optic) (74f8ea1)
  • instrument services.clickhouse.client (optic) (d674a96)
  • instrument services.cache (optic) (6d8c38f)
  • instrument services.anti_gaming (optic) (d17709d)
  • instrument services.alert_evaluator (optic) (a6781c9)
  • instrument services.agent_snapshot (optic) (23f0a04)
  • instrument services.agent_resolver (optic) (c1ddbd0)
  • instrument services.agent_registry_cache (optic) (c079360)
  • instrument services.agent_lock_file (optic) (57ade8f)
  • instrument services.agent_builder (optic) (cc5cf8c)
  • instrument observal-server.pyproject.toml (optic) (d7d098f)
  • instrument jobs.maintenance (optic) (bfed99e)
  • instrument jobs.catalog (optic) (dc97b30)
  • instrument api.routes.telemetry (optic) (77ba7bb)
  • instrument api.routes.support (optic) (31d4d5d)
  • instrument api.routes.skill (optic) (3036f8a)
  • instrument api.routes.sessions (optic) (0e0c120)
  • instrument api.routes.sandbox (optic) (9efaf4d)
  • instrument api.routes.review (optic) (eaa25f8)
  • instrument api.routes.registry_models (optic) (b28ffda)
  • instrument api.routes.reconcile (optic) (fb97f8b)
  • instrument api.routes.prompt (optic) (6ace51f)
  • instrument api.routes.preview (optic) (acf3506)
  • instrument api.routes.mcp (optic) (28a0211)
  • instrument api.routes.jwks (optic) (5a2d119)
  • instrument api.routes.insights (optic) (086602b)
  • instrument api.routes.ingest (optic) (c3bd8d6)
  • instrument api.routes.hook (optic) (e44aa31)
  • instrument api.routes.feedback (optic) (9d48a2e)
  • instrument api.routes.device_auth (optic) (bf3b0d6)
  • instrument api.routes.dashboard (optic) (57e7a4b)
  • instrument api.routes.config (optic) (3ebf19d)
  • instrument api.routes.component_versions (optic) (5215cd6)
  • instrument api.routes.component_source (optic) (d5f6351)
  • instrument api.routes.bulk (optic) (59a637b)
  • instrument api.routes.auth (optic) (20e8fe0)
  • instrument api.routes.alert (optic) (4c9af4e)
  • instrument api.routes.agent.install (optic) (9ba4440)
  • instrument api.routes.agent.draft (optic) (d691b1a)
  • instrument api.routes.agent.crud (optic) (6fa0f2f)
  • instrument api.routes.agent_versions (optic) (ac5185f)
  • instrument api.routes.admin.users (optic) (650f309)
  • instrument api.routes.admin.retention (optic) (7e05da4)
  • instrument api.routes.admin.org (optic) (f38e5f7)
  • instrument api.routes.admin.enterprise_settings (optic) (10a85a5)
  • instrument observal_cli.telemetry_buffer (optic) (b989cf2)
  • instrument observal_cli.shim (optic) (69e06c1)
  • instrument observal_cli.settings_reconciler (optic) (d4fb86e)
  • instrument server.orchestrator (optic) (6f1fcbf)
  • instrument server.deps (optic) (bdbf0ab)
  • instrument server.constants (optic) (7accfa5)
  • instrument server.config_gen (optic) (d34693e)
  • instrument server.init (optic) (15ac6ee)
  • instrument observal_cli.requirements.txt (optic) (c19aab9)
  • instrument observal_cli.proxy (optic) (de35a58)
  • instrument observal_cli.optic (optic) (dfe443b)
  • instrument observal_cli.main (optic) (d8821c7)
  • instrument observal_cli.cmd_uninstall (optic) (90c02f6)
  • instrument observal_cli.cmd_tail_flush (optic) (cc6858c)
  • instrument observal_cli.cmd_support (optic) (75e9381)
  • instrument observal_cli.cmd_skill (optic) (e15fc62)
  • instrument observal_cli.cmd_server (optic) (19249a7)
  • instrument observal_cli.cmd_scan (optic) (99830eb)
  • instrument observal_cli.cmd_sandbox (optic) (73e59f5)
  • instrument observal_cli.cmd_reconcile (optic) (3fbf817)
  • instrument observal_cli.cmd_pull (optic) (ae4117e)
  • instrument observal_cli.cmd_prompt (optic) (bb82c98)
  • instrument observal_cli.cmd_profile (optic) (dae194c)
  • instrument observal_cli.cmd_ops (optic) (5314d48)
  • instrument observal_cli.cmd_models (optic) (5c4b36a)
  • instrument observal_cli.cmd_mcp (optic) (1d24033)
  • instrument observal_cli.cmd_logs (optic) (ae71dd4)
  • instrument observal_cli.cmd_hook (optic) (dbaaa7e)
  • instrument observal_cli.cmd_doctor (optic) (d48f198)
  • instrument observal_cli.cmd_component (optic) (c93e7a3)
  • instrument observal_cli.cmd_auth (optic) (1d69bb1)
  • instrument observal_cli.cmd_agent (optic) (7f6582d)
  • instrument observal_cli.client (optic) (6011d2d)
  • instrument observal_cli.analyzer (optic) (ad42c87)
  • instrument docker.docker-compose.yml (optic) (ac70eaf)
  • instrument ..AGENTS.md (optic) (76223d1)
  • add cli, server, and web area labels to PR auto-labeler (ci) (34341e0)
  • gate server upgrade/rollback/versions to super_admin, bump web/package.json in releases (51d6214)
  • version mismatch banner, feature registry sync, lint fix (frontend) (b4edc4e)
  • add server upgrade/rollback/versions commands (server-update) (d629967)
  • version negotiation middleware + feature registry (negotiation) (a6618d9)
  • implement upgrade, downgrade, rollback, status commands (self-update) (db308a0)
  • add background GitHub release checker with 24h cache (version-check) (76e3a62)
  • sandbox MCP server — sandboxes as callable tools (7f5e85f)
  • inject sandbox usage instructions into agent rules on pull (c605d8b)
  • add script editor to hook submit/edit forms in frontend (4879e70)
  • materialize hook components on agent pull/install (b1831a0)
  • hooks & sandboxes cleanup — CLI, multi-IDE install, dead field removal (b9ae423)
  • add non-interactive flags to agent create (cli) (b7fffc1)
  • auto-install observal skill on login (cli) (5ebbfd2)
  • add observal skill for LLM-driven agent management (skill) (c144c62)
  • license-based feature gating and settings page redesign (web) (1ac2d0a)
  • add DB-backed dynamic_settings service with Fernet encryption (2b8196f)
  • move exec dashboard to ee/ with license gating (ee) (3b05e4e)
  • add tooltips to adoption, cost, investments, and velocity charts (dashboard) (1ef1af3)
  • LLM-powered AI Insights tab (dashboard) (650f81c)
  • comparative period overlays and CSV/PDF export (dashboard) (71abfb9)
  • inactivity alerts and time-to-value metrics (dashboard) (a475df5)
  • cost-per-dept KPIs, bulk dept import, category on approval (dashboard) (5f9f245)
  • UX improvements — URL tabs, range picker, onboarding, refresh (dashboard) (70e2d8e)
  • developer breakdown and model provider comparison (dashboard) (ada4c16)
  • strategic insights, ROI projections, enterprise-only gate (dashboard) (04aec31)
  • category selector, department assignment, baselines config (dashboard) (9340bb3)
  • insights tab and final polish (dashboard) (ee97cbe)
  • departments and cost intelligence tabs (dashboard) (16e1592)
  • adoption, investments, and velocity tabs with respective endpoints (dashboard) (3cef4ab)
  • management dashboard models, migration, tabbed layout (dashboard) (345ce04)

Changed

  • migrate scanning logic into IDE adapters (scan) (f03d928)
  • remove vscode IDE, add protocol.py and feature-flag gating (ide) (3ee21cc)
  • deduplicate _KIRO_EVENT_MAP into single definition (ide) (88ffd50)
  • add IDE adapter protocol and registry with 9 adapters (cli) (8402ade)
  • extract upgrade_executor, server version helper, harden caches (cli) (57dc647)
  • delete agent_config_generator.py, update all callers (ide) (c6c97c7)
  • direct adapter replacement, eliminate shim layer (ide) (d27423f)
  • remove dead if/elif chains from generate_agent_config (ide) (54fbb7c)
  • add adapter protocol and 9 IDE adapters with delegation (ide) (406777f)
  • replace per-IDE configure calls with doctor on login (auth) (fa61dc9)
  • split admin route monolith into sub-package (api) (5c8e59e)
  • split agent route monolith into sub-package (api) (9bb6f4a)
  • update enterprise code to use dynamic_settings (ee) (d77f0d6)
  • migrate API routes and services to dynamic_settings (f16117e)
  • squash Alembic migrations into v1_baseline stamp (ba03f41)
  • split job definitions into jobs/ subpackage (worker) (4d286b8)

Documentation

  • add gitbook docs for server and self commands, update SUMMARY (cli/server) (780c1bc)
  • add --help docstrings and gitbook docs for doctor, scan, migrate, support, profile, models, and uninstall commands (cli/infra) (dd41e29)
  • add --help docstrings and gitbook docs for ops, admin, review, eval, and self commands (cli/ops) (acf73b5)
  • add --help docstrings and gitbook docs for all registry commands (cli/registry) (af03e32)
  • add --help docstrings and gitbook docs for agent commands (cli/agent) (bd06fbd)
  • add --help docstrings and gitbook docs for auth and config commands (cli/auth) (9371f73)
  • add usage examples to agent publish, release, and pull --help (cli) (db6c4ba)
  • uncomment SAML and license vars in .env.example (env) (44f7e53)
  • add OBSERVAL_LICENSE_KEY to .env.example (env) (e41e0fe)

Fixed

  • remove Minimum CLI Version setting (settings) (8d8101a)
  • remove dead _checkVersionMismatch code, add clarifying comments (6f524c5)
  • remove stale Min-CLI header, fix health check port resolution (server) (1d9f0bb)
  • remove dead observal_url param from _gemini_settings, fix em-dash (9801014)
  • stop generating OTLP env vars in config snippets (config) (9991547)
  • use block scalar style for long YAML values in review diff (review) (ab98781)
  • show agent prompt in review queue and diff sheet (review) (5a5ea64)
  • Kiro agent pull writes hook scripts and rewrites command paths (a3505bc)
  • rewrite bare script filenames to .claude/hooks/ path in frontmatter (02a75c0)
  • include description in Claude Code agent frontmatter (d708348)
  • deliver hook script files on agent pull for all IDEs (58db0a5)
  • expand ~ paths in hook install instead of creating literal ~/dir (c2247d6)
  • hook install command writes config to IDE settings file (6dd4d5a)
  • remove dead field references from frontend components (2be988e)
  • improve chart readability and UI clarity across tabs (dashboard) (2eb1fe8)
  • clamp future sentinel timestamps at ingest in _normalize_ts (traces) (8eaad86)
  • chart visual polish — dark tooltips, cleaner axes, token formatting (dashboard) (ebecdd9)
  • show dash for Kiro sessions with no credits instead of N prompts (traces) (a156f65)
  • add edit baselines button and fix useState in cost tab (dashboard) (a786deb)
  • fix bare f-strings and formatting in exec dashboard seed script (dashboard) (5ca7f18)
  • renumber exec dashboard migration to 0011 to avoid collision with retention 0010 (migration) (318731d)
  • request groups scope from OIDC provider for department auto-mapping (auth) (a213447)
  • remove invalid PreviewPanel props, run ruff format (ci) (644f191)
  • resolve ruff, eslint, and REUSE compliance issues (lint) (863d7f7)
  • honest metrics — cost/session, data-driven confidence, no fake composite (dashboard) (0aafe2f)
  • correct down_revision chain and PreviewPanel props (migration) (fd7f6e5)

Other

  • remove eval docs and grafana dashboard (3a33d88)
  • remove eval tests (84f5ea5)
  • remove eval frontend (ebe5efc)
  • remove eval CLI commands (89b3c33)
  • remove eval engine backend (f30d626)
  • extract call_model into insights service (c81425c)
  • address PR review, fix lint, add docs (513c916)
  • clean up .env.example and docker-compose for v1.0 (d8601f0)

Testing

  • update mocks for dynamic_settings migration (3277ddd)
  • add exec dashboard API tests, formula tests, and seed scripts (dashboard) (3d0cc20)

Security

  • add path traversal guard to hook file writes (fc5232b)

Breaking Changes

  • Removed Minimum CLI Version setting (settings)
  • Deleted vscode IDE, agent_config_generator.py, dead code paths, and various deprecated fields across services

Security Fixes

  • Added path traversal guard to hook file writes (Security)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track BlazeUp-AI/Observal](https:

Get notified when new releases ship.

Sign up free

About BlazeUp-AI/Observal](https:

All releases →

Related context

Earlier breaking changes

  • v1.2.0 Removes legacy pre-JSONL modules in insights.
  • v1.2.0 Removes agent visibility and team access features.
  • v1.1.0 Replace deployment_mode API field with licensed boolean.
  • v0.8.0 Removes goal template, replaces with required prompt field in agent configuration.

Beta — feedback welcome: [email protected]