Get early access
Home · Changelog

Changelog

What we shipped, when we shipped it, and what we broke. Updates from the HostAtlas team — usually weekly, occasionally biweekly when someone takes vacation.

RSS · Atom via email · weekly digest v3.4.2 · current stable
12 releases Jan 17, 2026 – Apr 28, 2026 median 8 days apart
FebMarApr 3.1.03.2.03.3.03.4.0
Apr 28, 2026 3.4.0 "Forensic"
MajorFeature

Forensic Mode is out of beta. Time-travel for your fleet.

Drag a slider on any incident timeline. See every host, every config file, every running container, every recent command — exactly as it was at 14:31:47. The retro you never had time to write, now drafted for you.

forensic · keywest · timeline 2026-04-30 · 14:31:47
14:0014:3015:0015:30
What's new
  • Fleet-wide diff between any two timestamps. hostatlas forensic diff 14:00 14:35
  • Auto-generated postmortem draft — markdown, with cited log lines and metric snapshots
  • 30-day retention on Team, 1 year on Enterprise. Read-only, immutable, signed.
  • Container, k8s pod, and systemd unit states are now snapshotted alongside metrics
Why this took 8 months: snapshotting every config file across thousands of hosts without filling everyone's disk turned out to be 70% of the work. We landed on per-host content-addressed storage with sub-second restore. The other 30% was the UI for "drag to time-travel".
D @dmitri · @anna read announcement migration guide · 4,217 reads · 28 replies
Apr 14, 2026 3.3.0 "Recipe"
Feature

Automation Recipes — the community library, opened up.

28 production-grade automations, cloned ~14k times during the closed beta. Fork, rename, ship. Every recipe has a public diff, a real run history, and a button that says use as starting point.

Highlights
  • Disk fill auto-rotate — 3.2k forks. Your 3 AM page, retired.
  • CVE → 1-PR-per-service — version bump PRs across the fleet, just press merge
  • SSL renew + reload — covers blue/green LBs, no more manual nginx -s reload
  • Recipe pages now show real run history (anonymized) so you know it's not theoretical
L @luca browse recipes · 2,891 reads
Apr 03, 2026 3.2.4
SecurityFix

Patch: CVE-2026-1142 · webhook signature replay window

Webhook signatures had a 5-minute replay window that should have been 30 seconds. Patched, no exploitation observed in audit logs. We owe a thank-you to @bytewright on the security disclosure program.

What you need to do
  • Self-hosted: upgrade to 3.2.4. Cloud: already patched.
  • If you reuse webhook signatures across >30 seconds anywhere, those flows will now reject. migration note.
--- a/webhooks/verify.go
+++ b/webhooks/verify.go
- if abs(now - signed_at) > 5 * time.Minute {
+ if abs(now - signed_at) > 30 * time.Second {
    return ErrSignatureExpired
  }
S @security advisory CVE-2026-1142
Mar 21, 2026 3.2.0 "MCP"
Feature

21 MCP tools — bring your own model.

HostAtlas now ships an MCP server. Plug it into Claude Desktop, Cursor, your local agent, and you get a real assistant that can do things, not just talk about them. 21 tools across hosts, logs, alerts, automations, configs, backups, and audit.

// claude_desktop_config.json
"mcpServers": {
  "hostatlas": {
    "command": "hostatlas",
    "args": ["mcp", "--token", "$HA_TOKEN"]
  }
}
Default scopes are read-only. Write-action tools (restart_service, run_playbook, etc.) require an --allow-writes flag at server start. We'd rather you opt in twice than once too few.
J @jordan MCP setup guide tool reference
Mar 12, 2026 3.1.7
Fix
k8s context picker stopped showing namespaces with more than 200 pods after a re-render fix. Reverted that fix, written better fix. Sorry to anyone who lost --namespace ingress-controller for 4 days.
Mar 06, 2026 3.1.6
Feature
Ruby SDK goes 1.0. Same auth, same audit log, same retries-with-jitter. gem install hostatlas. Sorbet types included.
Feb 27, 2026 3.1.5
FixFeature
Mobile app now lets you ack alerts in airplane mode (queues and replays on reconnect). Also: stopped showing 4 AM "everything's fine" notifications during your maintenance windows. That one took us a while.
Feb 19, 2026 3.1.4
Feature
hostatlas why can now read across hosts. hostatlas why is the API slow walks the whole request path — LB, app, DB, cache — instead of guessing one host.
Feb 11, 2026 3.1.3
Fix
Domain expiry watcher was off-by-one on leap years. The leap year was 4 days ago. Apologies to the four customers who got a "renew tomorrow" alert one day too late.
Feb 03, 2026 3.1.2
Feature
Server detail page got a Forensic tab (still in beta then). Also: dark mode finally matches the system preference automatically. We know. We're sorry it took this long.
Jan 25, 2026 3.1.0 "Anomaly"
Feature
Anomaly detection is now per-metric, per-host, holiday-aware. We learn the rhythm of every metric on every host. No global thresholds, no 3 AM page during Black Friday traffic. Trained on 7-day rolling window, updates continuously.
Jan 17, 2026 3.0.4
Fix
A few small things that nonetheless matter. The Network Map no longer freezes on fleets > 800 hosts. Tooltip z-index was wrong on Domain Detail. Audit log search now uses prefix matching for hostnames. full diff →

Want this in your inbox?

Weekly digest, no marketing, no growth-hacker subject lines. Unsubscribe in one click.

Subscribe to changelog RSS feed →