What openchoreo/openchoreo shipped
Written by FoxPlug from the repository's own releases; not affiliated with Openchoreo. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/openchoreo/openchoreo; Openchoreo did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Released v1.4.0-m.2, a maintenance release including notification channel fixes and version bumps. Release
- Added a raw trace query endpoint to the observer so platform engineers can send the tracing backend's own search request. Pull request #5064
- Added controller flags to configure the RenderedRelease stable and progressing requeue intervals instead of hard-coding them. Pull request #5343
- Added an opt-in rollout mode where only the configuration pods actually reference is rolled out, instead of every rendered data plane resource. Pull request #5275
- Fixed the RenderedRelease controller to match live resources by identity, so copied labels on generated Secrets are no longer misattributed. Pull request #5327
- Stopped the RenderedRelease controller from requeuing on its own status writes. Pull request #5330
- The cluster agent now detects dead gateway connections and bounds writes and backend requests. Pull request #5328
- Notification channels are now looked up in the alert's namespace, so alerts cannot go to a same-named channel in another namespace. Pull request #5280
- Fixed notification channel creation so the channel namespace is created on the observability plane when it runs on its own cluster. Pull request #5302
- Deleting a control plane namespace now also deletes its plane namespaces and their secrets. Pull request #5303
Why it matters
This week brings a new maintenance release plus fixes that make alerting and release management more predictable. Notification channels are now resolved per namespace and set up correctly on separate observability planes, while release rolling and controller requeuing are more controlled and configurable.
Changelog entry
- Release v1.4.0-m.2. Release
- Added the v1.4.0-m.2 changelog entry. Pull request #5359
- Added raw trace queries to the observer. Pull request #5064
- Added flags for RenderedRelease requeue intervals. Pull request #5343
- Added opt-in referenced-config rollout. Pull request #5275
- RenderedRelease now matches live resources by identity. Pull request #5327
- Stopped RenderedRelease requeueing on its own status writes. Pull request #5330
- Detect dead gateway connections and bound writes and backend requests. Pull request #5328
- Look up notification channels in the alert's namespace. Pull request #5280
- Create notification channel namespace on the observability plane. Pull request #5302
- Delete plane namespaces with their control plane namespace. Pull request #5303
- Renamed the EndpointType protocol enum to EndpointProtocol. Pull request #5349
V1.4.0-m.2 is out. This week: raw trace queries in the observer, configurable RenderedRelease requeue intervals, opt-in referenced-config rollout, identity-based resource matching in the controller, and notification channel lookups fixed to the alert's namespace.
Openchoreo v1.4.0-m.2 is now available. This week's changes include a raw trace query endpoint in the observer so platform engineers can send the tracing backend's own search request, controller flags for the RenderedRelease stable and progressing requeue intervals, and an opt-in rollout mode that only rolls the configuration pods reference. On the reliability side, the RenderedRelease controller now matches live resources by identity and no longer requeues on its own status writes, the cluster agent detects dead gateway connections, and notification channels are looked up in the alert's namespace. Namespace deletion on the control plane now also cleans up plane namespaces and their secrets.
Week of October 12, 2026
What shipped
- Added auditing for reads that disclose sensitive data, recording what each read was asked for and what it returned, never the content. Pull request #4986
- The e2e setup now installs the observability-logs-opensearch module in one step instead of installing without Fluent Bit and enabling it in a second upgrade. Pull request #4977
- Grouped Go Dependabot updates and extended coverage to golang.org/x modules, after the open pull request limit of 10 had blocked Go module PRs including grpc 1.83.1 and 1.83.2 security fixes. Pull request #4945
- Added SLTMobitel to the adopters list as an end user. Pull request #4985
- Added a root CONTRIBUTING.md that links to the contributor guide in docs/contributors/README.md so issue and pull request pages point to it. Pull request #4934
Why it matters
Sensitive reads can now be audited by request and response metadata without capturing content, and the observer API, the auditlogs command and the query tool expose the new records. The e2e setup gets simpler with a single install step for the logs module, and Dependabot is unblocked so Go module and golang.org/x updates can open again. The repository also gains a root contributing file and a new end user in the adopters list.
Changelog entry
- Audit reads that disclose sensitive data, recording the request and returned metadata but never the content Pull request #4986
- Install observability-logs-opensearch in one step in e2e setup Pull request #4977
- Group Go Dependabot updates and cover golang.org/x modules Pull request #4945
- Add SLTMobitel to the adopters list as an end user Pull request #4985
- Add root CONTRIBUTING.md pointing to the contributor guide Pull request #4934
This week: auditing for sensitive reads with request and response metadata but never content; one-step observability-logs-opensearch install in e2e setup; grouped Go Dependabot updates covering golang.org/x modules; a root CONTRIBUTING.md; SLTMobitel added as an end user.
This week in the project: reads that disclose sensitive data are now audited, recording what each read was asked for and what it returned, never the content, and the observer API, the auditlogs command and the query tool return the new records. The e2e setup installs observability-logs-opensearch in one step, since the logs module now enables Fluent Bit by default. Dependabot now groups Go updates and covers golang.org/x modules, after the open pull request limit had blocked Go module PRs and security fixes. A root CONTRIBUTING.md links to the contributor guide, and SLTMobitel joined the adopters list as an end user.
Week of September 28, 2026
What shipped
- V1.3.1 released with fixes for audit log context scoping, service account actor IDs, and helm readable ID claims. Release
- V1.2.7 released with observability service ingress restrictions and single-object report authorization fixes. Release
- Occ releasebinding tree command added to show release binding resource trees with discovery warnings and filtering options. Pull request #4747
- Components with resource dependencies now emit delivery events for accurate Deployment Frequency, Lead Time, and Change Failure Rate calculations. Pull request #4849
- Observer MCP tools now return consistent error messages instead of raw internal service errors to callers. Pull request #4847
- Occ component logs --follow fixed to preserve sub-second precision and eliminate duplicate log entries. Pull request #4840
- Component admission webhook now validates names against DNS-1035 format at creation time to prevent later deployment failures. Pull request #3640
- Generated container specs now include explicit ports blocks so workload endpoints can be targeted by port name. Pull request #4382
- AutoDeploy webhook rejections now emit Kubernetes events so users can discover deployment failures in component status. Pull request #3924
- Observer MCP authorization denial messages updated to match REST handler format in test expectations. Pull request #4865
Why it matters
Three patch releases address audit logging, authorization, and delivery metrics tracking. The new releasebinding tree command and fixes to component validation and logging improve operational visibility and prevent silent failures.
Changelog entry
- V1.3.1: fix(cli) occ auditlogs context scoping and ascending paging; fix service account actor IDs in audit events; fix helm
readable_id_claimconfiguration Release - V1.2.7: fix(helm) restrict observability service ingress; fix single-object report authorization against report's own project Release
- Fix(cli): keep sub-second precision in occ component logs --follow Pull request #4840
- Fix(controller): emit delivery events for components with resource dependencies Pull request #4849
- Feat(cli): add occ releasebinding tree command to show resource trees with discovery warnings Pull request #4747
- Fix: observer MCP tools return consistent error messages instead of raw service errors Pull request #4847
- Fix(controller): validate component names against DNS-1035 format at admission time Pull request #3640
- Fix(controller): add container ports to workload specs for port-by-name targeting Pull request #4382
- Fix: emit Kubernetes events on autoDeploy webhook rejections Pull request #3924
Openchoreo v1.3.1 and v1.2.7 released. Fixes for audit logs, delivery metrics, and component validation. New occ releasebinding tree command for resource exploration.
Openchoreo releases v1.3.1 and v1.2.7 this week with improvements across audit logging, authorization, and delivery metrics. Components with resource dependencies now correctly emit events for DORA calculations. New occ releasebinding tree command enables resource exploration. DNS-1035 validation prevents silent component naming failures.
Week of September 21, 2026
What shipped
- V1.3.0 released with Audit Logs (beta) for recording state-modifying operations across REST API and MCP servers, readable from portal, occ command, or MCP tool. Release
- V1.3.0-rc.1 released with Audit Logs and Cost Insights features. Release
- V1.3.0-rc.2 released as follow-up to rc.1. Release
- Cluster hooks feature added to the project. Pull request #4829
- Audit events from service accounts now record real actor.id instead of unknown. Pull request #4814
- Occ auditlogs command fixed to properly scope context and handle ascending paging. Pull request #4831
- Readable_id_claim made optional in control plane Helm schema to fix upgrade failures. Pull request #4837
- Observability service ingress restricted in release-v1.1 backport while preserving required platform communication. Pull request #4810
- CI workflow split to separate candidate publication from build-and-test validation. Pull request #4812
- Hook enable flag removed. Pull request #4839
Why it matters
V1.3.0 brings audit logging to beta, allowing users to track all state-modifying operations across the platform with multiple access methods. This week includes fixes for service account auditing, Helm schema compatibility, and CLI command scoping to ensure the audit feature works reliably.
Changelog entry
- V1.3.0: Audit Logs (beta) for REST API and MCP servers; Cost Insights feature Release
- Feat: add cluster hooks feature Pull request #4829
- Fix: record real actor.id for service accounts in audit events Pull request #4814
- Fix(cli): fix occ auditlogs context scoping and ascending paging Pull request #4831
- Fix(helm): make
readable_id_claimoptional in control plane schema Pull request #4837 - Fix(helm): restrict observability service ingress (backport to release-v1.1) Pull request #4810
- Ci: split publish workflow into separate reusable workflow Pull request #4812
- Chore: pin observability modules on release-v20260924 Pull request #4833
- Fix: remove hook enable flag Pull request #4839
Openchoreo v1.3.0 is here. Audit Logs (beta) now captures every state-modifying operation across REST API and MCP servers—readable from portal, occ command, or MCP tool.
Openchoreo v1.3.0 is available. Audit Logs (beta) brings full visibility into state-modifying operations across the platform. Every change is now recorded in a policy-driven audit trail, accessible through the portal, occ auditlogs command, or as an MCP tool. Fixes include service account auditing, Helm schema compatibility, and CLI improvements.
Week of September 14, 2026
What shipped
- V1.3.0 is now marked as a GA release in the changelog. Pull request #4803
- Delivery Insights read API and logs-adapter events source shipped, letting users query delivery metrics through the observer. Pull request #4248
- Identity provider upgraded from Thunder 0.28.0 to ThunderID 1.0.1. Pull request #4751
- New occ auditlogs CLI command added to query audit logs with filtering support. Pull request #4754
- Audit actor identity claim is now configurable, allowing deployments to use readable identities like email instead of opaque token IDs. Pull request #4758
- Portal assistant auth config now derives from security.subjects configuration instead of requiring hand-written ConfigMaps. Pull request #4777
- SRE agent tooling broadened to include Kubernetes events and managed Resource state, with new extensions mechanism. Pull request #4743
- MCP HTTP servers upgraded to go-sdk v1.7.0 and now use stateless HTTP to support MCP 2026-07-28 protocol. Pull request #4721
- Audit logging now enabled by default in quick-start, k3d and e2e setups when observability plane is installed. Pull request #4763
- V1.2.6 released with WorkflowRun authorization fix and simplified git basic auth handling. Release
Why it matters
V1.3.0 moves to GA with significant new observability and audit capabilities. The Delivery Insights API lets users track deployment metrics, the new audit commands provide better visibility into system actions, and configuration improvements make deployments more flexible. Users upgrading get a modern identity provider, broader agent capabilities, and audit logging that works out of the box.
Changelog entry
- V1.3.0 GA release marking Pull request #4803
- Delivery Insights read API and logs-adapter events source Pull request #4248
- Occ auditlogs command for querying audit logs Pull request #4754
- Configurable audit actor ID claim (defaults to 'sub') Pull request #4758
- Identity provider upgraded to ThunderID 1.0.1 Pull request #4751
- Portal assistant auth config derived from security.subjects Pull request #4777
- SRE agent tooling broadened with Kubernetes events and Resource state Pull request #4743
- MCP HTTP servers upgraded to go-sdk v1.7.0 with stateless HTTP support Pull request #4721
- Audit logging enabled by default in quick-start, k3d and e2e setups with observability Pull request #4763
- V1.2.6 patch release with WorkflowRun authorization fix Release
V1.3.0 is now GA. Delivery Insights, configurable audit actor claims, and improved SRE tooling ship this week.
OpenChoreo v1.3.0 reaches GA with major observability improvements. New Delivery Insights read API and logs-adapter events source let you track deployment metrics. Audit logging works out of the box in local setups. The SRE agent can now see Kubernetes events and Resource state. Identity provider upgraded to ThunderID 1.0.1. Audit actor claims are configurable for better identity tracking.