Skip to content

BlazeUp-AI/Observal](https:

v1.2.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 8d AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agents antigravity claude-code cli-tool cursor cursor-ai
+13 more
evaluation insights kiro large-language-models litellm llm llm-evaluation llm-observability llmops monitoring observability playground self-hosted

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 8d

v1.2.0 removes agent visibility and team access features, as well as legacy pre‑JSONL modules in insights.

Why it matters: Breaking changes affect core platform functionality; operators must update integrations before upgrade to avoid loss of visibility and module support.

Summary

AI summary

Remove agent visibility, team access features and legacy pre‑JSONL modules (breaking changes).

Changes in this release

Security High

Prevents rate-limit bypass via X-Forwarded-For spoofing.

Prevents rate-limit bypass via X-Forwarded-For spoofing.

Source: llm_adapter@2026-05-26

Confidence: high

 —
Breaking High

Removes agent visibility and team access features.

Removes agent visibility and team access features.

Source: llm_adapter@2026-05-26

Confidence: low

 —
Breaking High

Removes legacy pre-JSONL modules in insights.

Removes legacy pre-JSONL modules in insights.

Source: llm_adapter@2026-05-26

Confidence: low

 —
Feature Low

Adds registry_direct delivery mode for inline skill submission (skills).

Adds registry_direct delivery mode for inline skill submission (skills).

Source: llm_adapter@2026-05-26

Confidence: high

 —
Feature Low

Adds co‑authoring for agents and components.

Adds co‑authoring for agents and components.

Source: llm_adapter@2026-05-26

Confidence: high

 —
Feature Low

Adds attribute pi sessions to the pulled agent (pi).

Adds attribute pi sessions to the pulled agent (pi).

Source: llm_adapter@2026-05-26

Confidence: high

 —
Feature Low

Adds insights report page with facets, charts, and personal sections (web).

Adds insights report page with facets, charts, and personal sections (web).

Source: llm_adapter@2026-05-26

Confidence: high

 —
Feature Low

Adds V5 pipeline with deterministic extraction and personal narratives (insights).

Adds V5 pipeline with deterministic extraction and personal narratives (insights).

Source: llm_adapter@2026-05-26

Confidence: high

 —
Dependency Medium

Bumps redis-py to >=5.0 for aclose() support.

Bumps redis-py to >=5.0 for aclose() support.

Source: llm_adapter@2026-05-26

Confidence: high

 —
Bugfix Medium

Adds CIDR support and default trusted proxies for Docker stack.

Adds CIDR support and default trusted proxies for Docker stack.

Source: llm_adapter@2026-05-26

Confidence: high

 —
Full changelog

[1.2.0] - 2026-05-26

Added

  • add co-authoring for agents and components (8c79024)
  • add registry_direct delivery mode for inline skill submission (skills) (42716a8)
  • attribute pi sessions to the pulled agent (pi) (ff09004)
  • insights report page with facets charts and personal sections (web) (ef18933)
  • V5 pipeline with deterministic extraction and personal narratives (insights) (8ad53d4)

Changed

  • remove agent visibility and team access features [BREAKING] (a35c629)

Documentation

  • add prompt CLI documentation (#1051) (6f99e7d)
  • rewrite README with updated screenshots and current feature set (6f156d8)

Fixed

  • bump redis-py to >=5.0 for aclose() support (server) (d48b6ff)
  • regenerate observal-server/uv.lock in release script (build) (9d44f3b)
  • add CIDR support and default trusted proxies for Docker stack (7003cdf)
  • prevent rate-limit bypass via X-Forwarded-For spoofing (security) (4dd8288)

Other

  • remove legacy pre-JSONL modules (insights) [BREAKING] (3c65d21)

Breaking Changes

  • Removed agent visibility and team access features
  • Removed legacy pre-JSONL modules

Security Fixes

  • Prevent rate-limit bypass via X-Forwarded-For spoofing
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track BlazeUp-AI/Observal](https:

Get notified when new releases ship.

Sign up free

About BlazeUp-AI/Observal](https:

All releases →

Related context

Earlier breaking changes

  • v1.1.0 Replace deployment_mode API field with licensed boolean.
  • v0.8.0 Removes goal template, replaces with required prompt field in agent configuration.

Beta — feedback welcome: [email protected]